v3.42.16: TUI cleanup - remove STATUS box, add global styles

- Block cluster restore if existing databases found and cleanup not enabled
- User must press 'c' to enable 'Clean All First' before proceeding
- Prevents accidental data conflicts during disaster recovery
- Bug #24: Missing safety gate for cluster restore

.gitea/workflows/ci.yml

@@ -37,90 +37,6 @@ jobs:
       - name: Coverage summary
         run: go tool cover -func=coverage.out | tail -1
 
-  test-integration:
-    name: Integration Tests
-    runs-on: ubuntu-latest
-    needs: [test]
-    container:
-      image: golang:1.24-bookworm
-    services:
-      postgres:
-        image: postgres:15
-        env:
-          POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: testdb
-        ports: ['5432:5432']
-      mysql:
-        image: mysql:8
-        env:
-          MYSQL_ROOT_PASSWORD: mysql
-          MYSQL_DATABASE: testdb
-        ports: ['3306:3306']
-    steps:
-      - name: Checkout code
-        env:
-          TOKEN: ${{ github.token }}
-        run: |
-          apt-get update && apt-get install -y -qq git ca-certificates postgresql-client default-mysql-client
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git init
-          git remote add origin "https://${TOKEN}@git.uuxo.net/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA}"
-          git checkout FETCH_HEAD
-
-      - name: Wait for databases
-        run: |
-          echo "Waiting for PostgreSQL..."
-          for i in $(seq 1 30); do
-            pg_isready -h postgres -p 5432 && break || sleep 1
-          done
-          echo "Waiting for MySQL..."
-          for i in $(seq 1 30); do
-            mysqladmin ping -h mysql -u root -pmysql --silent && break || sleep 1
-          done
-
-      - name: Build dbbackup
-        run: go build -o dbbackup .
-
-      - name: Test PostgreSQL backup/restore
-        env:
-          PGHOST: postgres
-          PGUSER: postgres
-          PGPASSWORD: postgres
-        run: |
-          # Create test data
-          psql -h postgres -c "CREATE TABLE test_table (id SERIAL PRIMARY KEY, name TEXT);"
-          psql -h postgres -c "INSERT INTO test_table (name) VALUES ('test1'), ('test2'), ('test3');"
-          # Run backup - database name is positional argument
-          mkdir -p /tmp/backups
-          ./dbbackup backup single testdb --db-type postgres --host postgres --user postgres --password postgres --backup-dir /tmp/backups --no-config --allow-root
-          # Verify backup file exists
-          ls -la /tmp/backups/
-
-      - name: Test MySQL backup/restore
-        env:
-          MYSQL_HOST: mysql
-          MYSQL_USER: root
-          MYSQL_PASSWORD: mysql
-        run: |
-          # Create test data
-          mysql -h mysql -u root -pmysql testdb -e "CREATE TABLE test_table (id INT AUTO_INCREMENT PRIMARY KEY, name VARCHAR(255));"
-          mysql -h mysql -u root -pmysql testdb -e "INSERT INTO test_table (name) VALUES ('test1'), ('test2'), ('test3');"
-          # Run backup - positional arg is db to backup, --database is connection db
-          mkdir -p /tmp/mysql_backups
-          ./dbbackup backup single testdb --db-type mysql --host mysql --port 3306 --user root --password mysql --database testdb --backup-dir /tmp/mysql_backups --no-config --allow-root
-          # Verify backup file exists
-          ls -la /tmp/mysql_backups/
-
-      - name: Test verify-locks command
-        env:
-          PGHOST: postgres
-          PGUSER: postgres
-          PGPASSWORD: postgres
-        run: |
-          ./dbbackup verify-locks --host postgres --db-type postgres --no-config --allow-root | tee verify-locks.out
-          grep -q 'max_locks_per_transaction' verify-locks.out
-
   lint:
     name: Lint
     runs-on: ubuntu-latest
@@ -140,7 +56,7 @@ jobs:
 
       - name: Install and run golangci-lint
         run: |
-          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.8.0
+          go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.62.2
           golangci-lint run --timeout=5m ./...
 
   build-and-release:
@@ -160,7 +76,6 @@ jobs:
           git init
           git remote add origin "https://${TOKEN}@git.uuxo.net/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}"
-          git fetch --tags origin
           git checkout FETCH_HEAD
 
       - name: Build all platforms

.gitea/workflows/ci.yml.bak-20260123

@@ -1,75 +0,0 @@
-# Backup of .gitea/workflows/ci.yml — created before adding integration-verify-locks job
-# timestamp: 2026-01-23
-
-# CI/CD Pipeline for dbbackup (backup copy)
-# Source: .gitea/workflows/ci.yml
-# Created: 2026-01-23
-
-name: CI/CD
-
-on:
-  push:
-    branches: [main, master, develop]
-    tags: ['v*']
-  pull_request:
-    branches: [main, master]
-
-jobs:
-  test:
-    name: Test
-    runs-on: ubuntu-latest
-    container:
-      image: golang:1.24-bookworm
-    steps:
-      - name: Checkout code
-        env:
-          TOKEN: ${{ github.token }}
-        run: |
-          apt-get update && apt-get install -y -qq git ca-certificates
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git init
-          git remote add origin "https://${TOKEN}@git.uuxo.net/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA}"
-          git checkout FETCH_HEAD
-
-      - name: Download dependencies
-        run: go mod download
-
-      - name: Run tests
-        run: go test -race -coverprofile=coverage.out ./...
-
-      - name: Coverage summary
-        run: go tool cover -func=coverage.out | tail -1
-
-  lint:
-    name: Lint
-    runs-on: ubuntu-latest
-    container:
-      image: golang:1.24-bookworm
-    steps:
-      - name: Checkout code
-        env:
-          TOKEN: ${{ github.token }}
-        run: |
-          apt-get update && apt-get install -y -qq git ca-certificates
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git init
-          git remote add origin "https://${TOKEN}@git.uuxo.net/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA}"
-          git checkout FETCH_HEAD
-
-      - name: Install and run golangci-lint
-        run: |
-          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.8.0
-          golangci-lint run --timeout=5m ./...
-
-  build-and-release:
-    name: Build & Release
-    runs-on: ubuntu-latest
-    needs: [test, lint]
-    if: startsWith(github.ref, 'refs/tags/v')
-    container:
-      image: golang:1.24-bookworm
-    steps: |
-      <trimmed for backup>
-

.gitignore

@@ -13,7 +13,8 @@ logs/
 /dbbackup
 /dbbackup_*
 !dbbackup.png
-bin/
+bin/dbbackup_*
+bin/*.exe
 
 # Ignore development artifacts
 *.swp
@@ -37,6 +38,3 @@ CRITICAL_BUGS_FIXED.md
 LEGAL_DOCUMENTATION.md
 LEGAL_*.md
 legal/
-
-# Release binaries (uploaded via gh release, not git)
-release/dbbackup_*

.golangci.yml

@@ -1,16 +1,16 @@
 # golangci-lint configuration - relaxed for existing codebase
-version: "2"
-
 run:
   timeout: 5m
+  tests: false
 
 linters:
-  default: none
+  disable-all: true
   enable:
     # Only essential linters that catch real bugs
     - govet
+    - ineffassign
 
-settings:
+linters-settings:
   govet:
     disable:
       - fieldalignment

AZURE.md

@@ -236,8 +236,8 @@ dbbackup cloud download \
 # Manual delete
 dbbackup cloud delete "azure://prod-backups/postgres/old_backup.sql?account=myaccount&key=KEY"
 
-# Automatic cleanup (keep last 7 days, min 5 backups)
-dbbackup cleanup "azure://prod-backups/postgres/?account=myaccount&key=KEY" --retention-days 7 --min-backups 5
+# Automatic cleanup (keep last 7 backups)
+dbbackup cleanup "azure://prod-backups/postgres/?account=myaccount&key=KEY" --keep 7
 ```
 
 ### Scheduled Backups
@@ -253,7 +253,7 @@ dbbackup backup single production_db \
   --compression 9
 
 # Cleanup old backups
-dbbackup cleanup "azure://prod-backups/postgres/?account=myaccount&key=${AZURE_STORAGE_KEY}" --retention-days 30 --min-backups 5
+dbbackup cleanup "azure://prod-backups/postgres/?account=myaccount&key=${AZURE_STORAGE_KEY}" --keep 30
 ```
 
 **Crontab:**
@@ -385,7 +385,7 @@ Tests include:
 ### 4. Reliability
 
 - Test **restore procedures** regularly
-- Use **retention policies**: `--retention-days 30`
+- Use **retention policies**: `--keep 30`
 - Enable **soft delete** in Azure (30-day recovery)
 - Monitor backup success with Azure Monitor
 

CHANGELOG.md

@@ -5,705 +5,6 @@ All notable changes to dbbackup will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [4.2.3] - 2026-01-30
-
-### Fixed - Cluster Restore Performance & Ctrl+C Handling
-
-- **Removed redundant gzip validation in cluster restore**
-  - `ValidateAndExtractCluster()` no longer calls `ValidateArchive()` internally
-  - Previously validation happened 2x before extraction (caller + internal)
-  - Eliminates duplicate gzip header reads on large archives
-  - Reduces cluster restore startup time
-
-- **Fixed Ctrl+C not working during extraction**
-  - Added `CopyWithContext()` function for context-aware file copying
-  - Extraction now checks for cancellation every 1MB of data
-  - Ctrl+C immediately interrupts large file extractions
-  - Partial files are cleaned up on cancellation
-  - Applies to both `ExtractTarGzParallel` and `extractArchiveWithProgress`
-
-## [4.2.2] - 2026-01-30
-
-### Fixed - Complete pgzip Migration (Backup Side)
-
-- **Removed ALL external gzip/pigz calls from backup engine**
-  - `internal/backup/engine.go`: `executeWithStreamingCompression` now uses pgzip
-  - `internal/parallel/engine.go`: Fixed stub gzipWriter to use pgzip
-  - No more gzip/pigz processes visible in htop during backup
-  - Uses klauspost/pgzip for parallel multi-core compression
-
-- **Complete pgzip migration status**:
-  - ✅ Backup: All compression uses in-process pgzip
-  - ✅ Restore: All decompression uses in-process pgzip  
-  - ✅ Drill: Decompress on host with pgzip before Docker copy
-  - ⚠️ PITR only: PostgreSQL's `restore_command` must remain shell (PostgreSQL limitation)
-
-## [4.2.1] - 2026-01-30
-
-### Fixed - Complete pgzip Migration
-
-- **Removed ALL external gunzip/gzip calls** - Systematic audit and fix
-  - `internal/restore/engine.go`: SQL restores now use pgzip stream → psql/mysql stdin
-  - `internal/drill/engine.go`: Decompress on host with pgzip before Docker copy
-  - No more gzip/gunzip/pigz processes visible in htop during restore
-  - Uses klauspost/pgzip for parallel multi-core decompression
-
-- **PostgreSQL PITR exception** - `restore_command` in recovery config must remain shell
-  - PostgreSQL itself runs this command to fetch WAL files
-  - Cannot be replaced with Go code (PostgreSQL limitation)
-
-## [4.2.0] - 2026-01-30
-
-### Added - Quick Wins Release
-
-- **`dbbackup health` command** - Comprehensive backup infrastructure health check
-  - 10 automated health checks: config, DB connectivity, backup dir, catalog, freshness, gaps, verification, file integrity, orphans, disk space
-  - Exit codes for automation: 0=healthy, 1=warning, 2=critical
-  - JSON output for monitoring integration (Prometheus, Nagios, etc.)
-  - Auto-generates actionable recommendations
-  - Custom backup interval for gap detection: `--interval 12h`
-  - Skip database check for offline mode: `--skip-db`
-  - Example: `dbbackup health --format json`
-
-- **TUI System Health Check** - Interactive health monitoring
-  - Accessible via Tools → System Health Check
-  - Runs all 10 checks asynchronously with progress spinner
-  - Color-coded results: green=healthy, yellow=warning, red=critical
-  - Displays recommendations for any issues found
-
-- **`dbbackup restore preview` command** - Pre-restore analysis and validation
-  - Shows backup format, compression type, database type
-  - Estimates uncompressed size (3x compression ratio)
-  - Calculates RTO (Recovery Time Objective) based on active profile
-  - Validates backup integrity without actual restore
-  - Displays resource requirements (RAM, CPU, disk space)
-  - Example: `dbbackup restore preview backup.dump.gz`
-
-- **`dbbackup diff` command** - Compare two backups and track changes
-  - Flexible input: file paths, catalog IDs, or `database:latest/previous`
-  - Shows size delta with percentage change
-  - Calculates database growth rate (GB/day)
-  - Projects time to reach 10GB threshold
-  - Compares backup duration and compression efficiency
-  - JSON output for automation and reporting
-  - Example: `dbbackup diff mydb:latest mydb:previous`
-
-- **`dbbackup cost analyze` command** - Cloud storage cost optimization
-  - Analyzes 15 storage tiers across 5 cloud providers
-  - AWS S3: Standard, IA, Glacier Instant/Flexible, Deep Archive
-  - Google Cloud Storage: Standard, Nearline, Coldline, Archive
-  - Azure Blob Storage: Hot, Cool, Archive
-  - Backblaze B2 and Wasabi alternatives
-  - Monthly/annual cost projections
-  - Savings calculations vs S3 Standard baseline
-  - Tiered lifecycle strategy recommendations
-  - Shows potential savings of 90%+ with proper policies
-  - Example: `dbbackup cost analyze --database mydb`
-
-### Enhanced
-- **TUI restore preview** - Added RTO estimates and size calculations
-  - Shows estimated uncompressed size during restore confirmation
-  - Displays estimated restore time based on current profile
-  - Helps users make informed restore decisions
-  - Keeps TUI simple (essentials only), detailed analysis in CLI
-
-### Documentation
-- Updated README.md with new commands and examples
-- Created QUICK_WINS.md documenting the rapid development sprint
-- Added backup diff and cost analysis sections
-
-## [4.1.4] - 2026-01-29
-
-### Added
-- **New `turbo` restore profile** - Maximum restore speed, matches native `pg_restore -j8`
-  - `ClusterParallelism = 2` (restore 2 DBs concurrently)
-  - `Jobs = 8` (8 parallel pg_restore jobs)
-  - `BufferedIO = true` (32KB write buffers for faster extraction)
-  - Works on 16GB+ RAM, 4+ cores
-  - Usage: `dbbackup restore cluster backup.tar.gz --profile=turbo --confirm`
-
-- **Restore startup performance logging** - Shows actual parallelism settings at restore start
-  - Logs profile name, cluster_parallelism, pg_restore_jobs, buffered_io
-  - Helps verify settings before long restore operations
-
-- **Buffered I/O optimization** - 32KB write buffers during tar extraction (turbo profile)
-  - Reduces system call overhead
-  - Improves I/O throughput for large archives
-
-### Fixed
-- **TUI now respects saved profile settings** - Previously TUI forced `conservative` profile on every launch, ignoring user's saved configuration. Now properly loads and respects saved settings.
-
-### Changed
-- TUI default profile changed from forced `conservative` to `balanced` (only when no profile configured)
-- `LargeDBMode` no longer forced on TUI startup - user controls it via settings
-
-## [4.1.3] - 2026-01-27
-
-### Added
-- **`--config` / `-c` global flag** - Specify config file path from anywhere
-  - Example: `dbbackup --config /opt/dbbackup/.dbbackup.conf backup single mydb`
-  - No longer need to `cd` to config directory before running commands
-  - Works with all subcommands (backup, restore, verify, etc.)
-
-## [4.1.2] - 2026-01-27
-
-### Added
-- **`--socket` flag for MySQL/MariaDB** - Connect via Unix socket instead of TCP/IP
-  - Usage: `dbbackup backup single mydb --db-type mysql --socket /var/run/mysqld/mysqld.sock`
-  - Works for both backup and restore operations
-  - Supports socket auth (no password required with proper permissions)
-
-### Fixed
-- **Socket path as --host now works** - If `--host` starts with `/`, it's auto-detected as a socket path
-  - Example: `--host /var/run/mysqld/mysqld.sock` now works correctly instead of DNS lookup error
-  - Auto-converts to `--socket` internally
-
-## [4.1.1] - 2026-01-25
-
-### Added
-- **`dbbackup_build_info` metric** - Exposes version and git commit as Prometheus labels
-  - Useful for tracking deployed versions across a fleet
-  - Labels: `server`, `version`, `commit`
-
-### Fixed
-- **Documentation clarification**: The `pitr_base` value for `backup_type` label is auto-assigned
-  by `dbbackup pitr base` command. CLI `--backup-type` flag only accepts `full` or `incremental`.
-  This was causing confusion in deployments.
-
-## [4.1.0] - 2026-01-25
-
-### Added
-- **Backup Type Tracking**: All backup metrics now include a `backup_type` label
-  (`full`, `incremental`, or `pitr_base` for PITR base backups)
-- **PITR Metrics**: Complete Point-in-Time Recovery monitoring
-  - `dbbackup_pitr_enabled` - Whether PITR is enabled (1/0)
-  - `dbbackup_pitr_archive_lag_seconds` - Seconds since last WAL/binlog archived
-  - `dbbackup_pitr_chain_valid` - WAL/binlog chain integrity (1=valid)
-  - `dbbackup_pitr_gap_count` - Number of gaps in archive chain
-  - `dbbackup_pitr_archive_count` - Total archived segments
-  - `dbbackup_pitr_archive_size_bytes` - Total archive storage
-  - `dbbackup_pitr_recovery_window_minutes` - Estimated PITR coverage
-- **PITR Alerting Rules**: 6 new alerts for PITR monitoring
-  - PITRArchiveLag, PITRChainBroken, PITRGapsDetected, PITRArchiveStalled,
-    PITRStorageGrowing, PITRDisabledUnexpectedly
-- **`dbbackup_backup_by_type` metric** - Count backups by type
-
-### Changed
-- `dbbackup_backup_total` type changed from counter to gauge for snapshot-based collection
-
-## [3.42.110] - 2026-01-24
-
-### Improved - Code Quality & Testing
-- **Cleaned up 40+ unused code items** found by staticcheck:
-  - Removed unused functions, variables, struct fields, and type aliases
-  - Fixed SA4006 warning (unused value assignment in restore engine)
-  - All packages now pass staticcheck with zero warnings
-
-- **Added golangci-lint integration** to Makefile:
-  - New `make golangci-lint` target with auto-install
-  - Updated `lint` target to include golangci-lint
-  - Updated `install-tools` to install golangci-lint
-
-- **New unit tests** for improved coverage:
-  - `internal/config/config_test.go` - Tests for config initialization, database types, env helpers
-  - `internal/security/security_test.go` - Tests for checksums, path validation, rate limiting, audit logging
-
-## [3.42.109] - 2026-01-24
-
-### Added - Grafana Dashboard & Monitoring Improvements
-- **Enhanced Grafana dashboard** with comprehensive improvements:
-  - Added dashboard description for better discoverability
-  - New collapsible "Backup Overview" row for organization
-  - New **Verification Status** panel showing last backup verification state
-  - Added descriptions to all 17 panels for better understanding
-  - Enabled shared crosshair (graphTooltip=1) for correlated analysis
-  - Added "monitoring" tag for dashboard discovery
-
-- **New Prometheus alerting rules** (`grafana/alerting-rules.yaml`):
-  - `DBBackupRPOCritical` - No backup in 24+ hours (critical)
-  - `DBBackupRPOWarning` - No backup in 12+ hours (warning)
-  - `DBBackupFailure` - Backup failures detected
-  - `DBBackupNotVerified` - Backup not verified in 24h
-  - `DBBackupDedupRatioLow` - Dedup ratio below 10%
-  - `DBBackupDedupDiskGrowth` - Rapid storage growth prediction
-  - `DBBackupExporterDown` - Metrics exporter not responding
-  - `DBBackupMetricsStale` - Metrics not updated in 10+ minutes
-  - `DBBackupNeverSucceeded` - Database never backed up successfully
-
-### Changed
-- **Grafana dashboard layout fixes**:
-  - Fixed overlapping dedup panels (y: 31/36 → 22/27/32)
-  - Adjusted top row panel widths for better balance (5+5+5+4+5=24)
-
-- **Added Makefile** for streamlined development workflow:
-  - `make build` - optimized binary with ldflags
-  - `make test`, `make race`, `make cover` - testing targets
-  - `make lint` - runs vet + staticcheck
-  - `make all-platforms` - cross-platform builds
-
-### Fixed
-- Removed deprecated `netErr.Temporary()` call in cloud retry logic (Go 1.18+)
-- Fixed staticcheck warnings for redundant fmt.Sprintf calls
-- Logger optimizations: buffer pooling, early level check, pre-allocated maps
-- Clone engine now validates disk space before operations
-
-## [3.42.108] - 2026-01-24
-
-### Added - TUI Tools Expansion
-- **Table Sizes** - view top 100 tables sorted by size with row counts, data/index breakdown
-  - Supports PostgreSQL (`pg_stat_user_tables`) and MySQL (`information_schema.TABLES`)
-  - Shows total/data/index sizes, row counts, schema prefix for non-public schemas
-
-- **Kill Connections** - manage active database connections
-  - List all active connections with PID, user, database, state, query preview, duration
-  - Kill single connection or all connections to a specific database
-  - Useful before restore operations to clear blocking sessions
-  - Supports PostgreSQL (`pg_terminate_backend`) and MySQL (`KILL`)
-
-- **Drop Database** - safely drop databases with double confirmation
-  - Lists user databases (system DBs hidden: postgres, template0/1, mysql, sys, etc.)
-  - Requires two confirmations: y/n then type full database name
-  - Auto-terminates connections before drop
-  - Supports PostgreSQL and MySQL
-
-## [3.42.107] - 2026-01-24
-
-### Added - Tools Menu & Blob Statistics
-- **New "Tools" submenu in TUI** - centralized access to utility functions
-  - Blob Statistics - scan database for bytea/blob columns with size analysis
-  - Blob Extract - externalize large objects (coming soon)
-  - Dedup Store Analyze - storage savings analysis (coming soon)
-  - Verify Backup Integrity - backup verification
-  - Catalog Sync - synchronize local catalog (coming soon)
-
-- **New `dbbackup blob stats` CLI command** - analyze blob/bytea columns
-  - Scans `information_schema` for binary column types
-  - Shows row counts, total size, average size, max size per column
-  - Identifies tables storing large binary data for optimization
-  - Supports both PostgreSQL (bytea, oid) and MySQL (blob, mediumblob, longblob)
-  - Provides recommendations for databases with >100MB blob data
-
-## [3.42.106] - 2026-01-24
-
-### Fixed - Cluster Restore Resilience & Performance
-- **Fixed cluster restore failing on missing roles** - harmless "role does not exist" errors no longer abort restore
-  - Added role-related errors to `isIgnorableError()` with warning log
-  - Removed `ON_ERROR_STOP=1` from psql commands (pre-validation catches real corruption)
-  - Restore now continues gracefully when referenced roles don't exist in target cluster
-  - Previously caused 12h+ restores to fail at 94% completion
-
-- **Fixed TUI output scrambling in screen/tmux sessions** - added terminal detection
-  - Uses `go-isatty` to detect non-interactive terminals (backgrounded screen sessions, pipes)
-  - Added `viewSimple()` methods for clean line-by-line output without ANSI escape codes
-  - TUI menu now shows warning when running in non-interactive terminal
-
-### Changed - Consistent Parallel Compression (pgzip)
-- **Migrated all gzip operations to parallel pgzip** - 2-4x faster compression/decompression on multi-core systems
-  - Systematic audit found 17 files using standard `compress/gzip`
-  - All converted to `github.com/klauspost/pgzip` for consistent performance
-  - **Files updated**:
-    - `internal/backup/`: incremental_tar.go, incremental_extract.go, incremental_mysql.go
-    - `internal/wal/`: compression.go (CompressWALFile, DecompressWALFile, VerifyCompressedFile)
-    - `internal/engine/`: clone.go, snapshot_engine.go, mysqldump.go, binlog/file_target.go
-    - `internal/restore/`: engine.go, safety.go, formats.go, error_report.go
-    - `internal/pitr/`: mysql.go, binlog.go
-    - `internal/dedup/`: store.go
-    - `cmd/`: dedup.go, placeholder.go
-  - **Benefit**: Large backup/restore operations now fully utilize available CPU cores
-
-## [3.42.105] - 2026-01-23
-
-### Changed - TUI Visual Cleanup
-- **Removed ASCII box characters** from backup/restore success/failure banners
-  - Replaced `╔═╗║╚╝` boxes with clean `═══` horizontal line separators
-  - Cleaner, more modern appearance in terminal output
-- **Consolidated duplicate styles** in TUI components
-  - Unified check status styles (passed/failed/warning/pending) into global definitions
-  - Reduces code duplication across restore preview and diagnose views
-
-## [3.42.98] - 2025-01-23
-
-### Fixed - Critical Bug Fixes for v3.42.97
-- **Fixed CGO/SQLite build issue** - binaries now work when compiled with `CGO_ENABLED=0`
-  - Switched from `github.com/mattn/go-sqlite3` (requires CGO) to `modernc.org/sqlite` (pure Go)
-  - All cross-compiled binaries now work correctly on all platforms
-  - No more "Binary was compiled with 'CGO_ENABLED=0', go-sqlite3 requires cgo to work" errors
-
-- **Fixed MySQL positional database argument being ignored**
-  - `dbbackup backup single <dbname> --db-type mysql` now correctly uses `<dbname>`
-  - Previously defaulted to 'postgres' regardless of positional argument
-  - Also fixed in `backup sample` command
-
-## [3.42.97] - 2025-01-23
-
-### Added - Bandwidth Throttling for Cloud Uploads
-- **New `--bandwidth-limit` flag for cloud operations** - prevent network saturation during business hours
-  - Works with S3, GCS, Azure Blob Storage, MinIO, Backblaze B2
-  - Supports human-readable formats:
-    - `10MB/s`, `50MiB/s` - megabytes per second
-    - `100KB/s`, `500KiB/s` - kilobytes per second  
-    - `1GB/s` - gigabytes per second
-    - `100Mbps` - megabits per second (for network-minded users)
-    - `unlimited` or `0` - no limit (default)
-  - Environment variable: `DBBACKUP_BANDWIDTH_LIMIT`
-  - **Example usage**:
-    ```bash
-    # Limit upload to 10 MB/s during business hours
-    dbbackup cloud upload backup.dump --bandwidth-limit 10MB/s
-    
-    # Environment variable for all operations
-    export DBBACKUP_BANDWIDTH_LIMIT=50MiB/s
-    ```
-  - **Implementation**: Token-bucket style throttling with 100ms windows for smooth rate limiting
-  - **DBA requested feature**: Avoid saturating production network during scheduled backups
-
-## [3.42.96] - 2025-02-01
-
-### Changed - Complete Elimination of Shell tar/gzip Dependencies
-- **All tar/gzip operations now 100% in-process** - ZERO shell dependencies for backup/restore
-  - Removed ALL remaining `exec.Command("tar", ...)` calls
-  - Removed ALL remaining `exec.Command("gzip", ...)` calls
-  - Systematic code audit found and eliminated:
-    - `diagnose.go`: Replaced `tar -tzf` test with direct file open check
-    - `large_restore_check.go`: Replaced `gzip -t` and `gzip -l` with in-process pgzip verification
-    - `pitr/restore.go`: Replaced `tar -xf` with in-process tar extraction
-  - **Benefits**:
-    - No external tool dependencies (works in minimal containers)
-    - 2-4x faster on multi-core systems using parallel pgzip
-    - More reliable error handling with Go-native errors
-    - Consistent behavior across all platforms
-    - Reduced attack surface (no shell spawning)
-  - **Verification**: `strace` and `ps aux` show no tar/gzip/gunzip processes during backup/restore
-  - **Note**: Docker drill container commands still use gunzip for in-container operations (intentional)
-
-## [Unreleased]
-
-### Added - Single Database Extraction from Cluster Backups (CLI + TUI)
-- **Extract and restore individual databases from cluster backups** - selective restore without full cluster restoration
-  - **CLI Commands**:
-    - **List databases**: `dbbackup restore cluster backup.tar.gz --list-databases`
-      - Shows all databases in cluster backup with sizes
-      - Fast scan without full extraction
-    - **Extract single database**: `dbbackup restore cluster backup.tar.gz --database myapp --output-dir /tmp/extract`
-      - Extracts only the specified database dump
-      - No restore, just file extraction
-    - **Restore single database from cluster**: `dbbackup restore cluster backup.tar.gz --database myapp --confirm`
-      - Extracts and restores only one database
-      - Much faster than full cluster restore when you only need one database
-    - **Rename on restore**: `dbbackup restore cluster backup.tar.gz --database myapp --target myapp_test --confirm`
-      - Restore with different database name (useful for testing)
-    - **Extract multiple databases**: `dbbackup restore cluster backup.tar.gz --databases "app1,app2,app3" --output-dir /tmp/extract`
-      - Comma-separated list of databases to extract
-  - **TUI Support**:
-    - Press **'s'** on any cluster backup in archive browser to select individual databases
-    - New **ClusterDatabaseSelector** view shows all databases with sizes
-    - Navigate with arrow keys, select with Enter
-    - Automatic handling when cluster backup selected in single restore mode
-    - Full restore preview and confirmation workflow
-  - **Benefits**:
-    - Faster restores (extract only what you need)
-    - Less disk space usage during restore
-    - Easy database migration/copying
-    - Better testing workflow
-    - Selective disaster recovery
-
-### Performance - Cluster Restore Optimization
-- **Eliminated duplicate archive extraction in cluster restore** - saves 30-50% time on large restores
-  - Previously: Archive was extracted twice (once in preflight validation, once in actual restore)
-  - Now: Archive extracted once and reused for both validation and restore
-  - **Time savings**:
-    - 50 GB cluster: ~3-6 minutes faster
-    - 10 GB cluster: ~1-2 minutes faster
-    - Small clusters (<5 GB): ~30 seconds faster
-  - Optimization automatically enabled when `--diagnose` flag is used
-  - New `ValidateAndExtractCluster()` performs combined validation + extraction
-  - `RestoreCluster()` accepts optional `preExtractedPath` parameter to reuse extracted directory
-  - Disk space checks intelligently skipped when using pre-extracted directory
-  - Maintains backward compatibility - works with and without pre-extraction
-  - Log output shows optimization: `"Using pre-extracted cluster directory ... optimization: skipping duplicate extraction"`
-
-### Improved - Archive Validation
-- **Enhanced tar.gz validation with stream-based checks**
-  - Fast header-only validation (validates gzip + tar structure without full extraction)
-  - Checks gzip magic bytes (0x1f 0x8b) and tar header signature
-  - Reduces preflight validation time from minutes to seconds on large archives
-  - Falls back to full extraction only when necessary (with `--diagnose`)
-
-### Added - PostgreSQL lock verification (CLI + preflight)
-- **`dbbackup verify-locks`** — new CLI command that probes PostgreSQL GUCs (`max_locks_per_transaction`, `max_connections`, `max_prepared_transactions`) and prints total lock capacity plus actionable restore guidance.
-- **Integrated into preflight checks** — preflight now warns/fails when lock settings are insufficient and provides exact remediation commands and recommended restore flags (e.g. `--jobs 1 --parallel-dbs 1`).
-- **Implemented in Go (replaces `verify_postgres_locks.sh`)** with robust parsing, sudo/`psql` fallback and unit-tested decision logic.
-- **Files:** `cmd/verify_locks.go`, `internal/checks/locks.go`, `internal/checks/locks_test.go`, `internal/checks/preflight.go`.
-- **Why:** Prevents repeated parallel-restore failures by surfacing lock-capacity issues early and providing bulletproof guidance.
-
-## [3.42.74] - 2026-01-20 "Resource Profile System + Critical Ctrl+C Fix"
-
-### Critical Bug Fix
-- **Fixed Ctrl+C not working in TUI backup/restore** - Context cancellation was broken in TUI mode
-  - `executeBackupWithTUIProgress()` and `executeRestoreWithTUIProgress()` created new contexts with `WithCancel(parentCtx)`
-  - When user pressed Ctrl+C, `model.cancel()` was called on parent context but execution had separate context
-  - Fixed by using parent context directly instead of creating new one
-  - Ctrl+C/ESC/q now properly propagate cancellation to running operations
-  - Users can now interrupt long-running TUI operations
-
-### Added - Resource Profile System
-- **`--profile` flag for restore operations** with three presets:
-  - **Conservative** (`--profile=conservative`): Single-threaded (`--parallel=1`), minimal memory usage
-    - Best for resource-constrained servers, shared hosting, or when "out of shared memory" errors occur
-    - Automatically enables `LargeDBMode` for better resource management
-  - **Balanced** (default): Auto-detect resources, moderate parallelism
-    - Good default for most scenarios
-  - **Aggressive** (`--profile=aggressive`): Maximum parallelism, all available resources
-    - Best for dedicated database servers with ample resources
-  - **Potato** (`--profile=potato`): Easter egg, same as conservative
-- **Profile system applies to both CLI and TUI**:
-  - CLI: `dbbackup restore cluster backup.tar.gz --profile=conservative --confirm`
-  - TUI: Automatically uses conservative profile for safer interactive operation
-- **User overrides supported**: `--jobs` and `--parallel-dbs` flags override profile settings
-- **New `internal/config/profile.go`** module:
-  - `GetRestoreProfile(name)` - Returns profile settings
-  - `ApplyProfile(cfg, profile, jobs, parallelDBs)` - Applies profile with overrides
-  - `GetProfileDescription(name)` - Human-readable descriptions
-  - `ListProfiles()` - All available profiles
-
-### Added - PostgreSQL Diagnostic Tools
-- **`diagnose_postgres_memory.sh`** - Comprehensive memory and resource analysis script:
-  - System memory overview with usage percentages and warnings
-  - Top 15 memory consuming processes
-  - PostgreSQL-specific memory configuration analysis
-  - Current locks and connections monitoring
-  - Shared memory segments inspection
-  - Disk space and swap usage checks
-  - Identifies other resource consumers (Nessus, Elastic Agent, monitoring tools)
-  - Smart recommendations based on findings
-  - Detects temp file usage (indicator of low work_mem)
-- **`fix_postgres_locks.sh`** - PostgreSQL lock configuration helper:
-  - Automatically increases `max_locks_per_transaction` to 4096
-  - Shows current configuration before applying changes
-  - Calculates total lock capacity
-  - Provides restart commands for different PostgreSQL setups
-  - References diagnostic tool for comprehensive analysis
-
-### Added - Documentation
-- **`RESTORE_PROFILES.md`** - Complete profile guide with real-world scenarios:
-  - Profile comparison table
-  - When to use each profile
-  - Override examples
-  - Troubleshooting guide for "out of shared memory" errors
-  - Integration with diagnostic tools
-- **`email_infra_team.txt`** - Admin communication template (German):
-  - Analysis results template
-  - Problem identification section
-  - Three solution variants (temporary, permanent, workaround)
-  - Includes diagnostic tool references
-
-### Changed - TUI Improvements
-- **TUI mode defaults to conservative profile** for safer operation
-  - Interactive users benefit from stability over speed
-  - Prevents resource exhaustion on shared systems
-  - Can be overridden with environment variable: `export RESOURCE_PROFILE=balanced`
-
-### Fixed
-- Context cancellation in TUI backup operations (critical)
-- Context cancellation in TUI restore operations (critical)
-- Better error diagnostics for "out of shared memory" errors
-- Improved resource detection and management
-
-### Technical Details
-- Profile system respects explicit user flags (`--jobs`, `--parallel-dbs`)
-- Conservative profile sets `cfg.LargeDBMode = true` automatically
-- TUI profile selection logged when `Debug` mode enabled
-- All profiles support both single and cluster restore operations
-
-## [3.42.50] - 2026-01-16 "Ctrl+C Signal Handling Fix"
-
-### Fixed - Proper Ctrl+C/SIGINT Handling in TUI
-- **Added tea.InterruptMsg handling** - Bubbletea v1.3+ sends `InterruptMsg` for SIGINT signals
-  instead of a `KeyMsg` with "ctrl+c", causing cancellation to not work
-- **Fixed cluster restore cancellation** - Ctrl+C now properly cancels running restore operations
-- **Fixed cluster backup cancellation** - Ctrl+C now properly cancels running backup operations
-- **Added interrupt handling to main menu** - Proper cleanup on SIGINT from menu
-- **Orphaned process cleanup** - `cleanup.KillOrphanedProcesses()` called on all interrupt paths
-
-### Changed
-- All TUI execution views now handle both `tea.KeyMsg` ("ctrl+c") and `tea.InterruptMsg`
-- Context cancellation properly propagates to child processes via `exec.CommandContext`
-- No zombie pg_dump/pg_restore/gzip processes left behind on cancellation
-
-## [3.42.49] - 2026-01-16 "Unified Cluster Backup Progress"
-
-### Added - Unified Progress Display for Cluster Backup
-- **Combined overall progress bar** for cluster backup showing all phases:
-  - Phase 1/3: Backing up Globals (0-15% of overall)
-  - Phase 2/3: Backing up Databases (15-90% of overall)
-  - Phase 3/3: Compressing Archive (90-100% of overall)
-- **Current database indicator** - Shows which database is currently being backed up
-- **Phase-aware progress tracking** - New fields in backup progress state:
-  - `overallPhase` - Current phase (1=globals, 2=databases, 3=compressing)
-  - `phaseDesc` - Human-readable phase description
-- **Dual progress bars** for cluster backup:
-  - Overall progress bar showing combined operation progress
-  - Database count progress bar showing individual database progress
-
-### Changed
-- Cluster backup TUI now shows unified progress display matching restore
-- Progress callbacks now include phase information
-- Better visual feedback during entire cluster backup operation
-
-## [3.42.48] - 2026-01-15 "Unified Cluster Restore Progress"
-
-### Added - Unified Progress Display for Cluster Restore
-- **Combined overall progress bar** showing progress across all restore phases:
-  - Phase 1/3: Extracting Archive (0-60% of overall)
-  - Phase 2/3: Restoring Globals (60-65% of overall)
-  - Phase 3/3: Restoring Databases (65-100% of overall)
-- **Current database indicator** - Shows which database is currently being restored
-- **Phase-aware progress tracking** - New fields in progress state:
-  - `overallPhase` - Current phase (1=extraction, 2=globals, 3=databases)
-  - `currentDB` - Name of database currently being restored
-  - `extractionDone` - Boolean flag for phase transition
-- **Dual progress bars** for cluster restore:
-  - Overall progress bar showing combined operation progress
-  - Phase-specific progress bar (extraction bytes or database count)
-
-### Changed
-- Cluster restore TUI now shows unified progress display
-- Progress callbacks now set phase and current database information
-- Extraction completion triggers automatic transition to globals phase
-- Database restore phase shows current database name with spinner
-
-### Improved
-- Better visual feedback during entire cluster restore operation
-- Clear phase indicators help users understand restore progress
-- Overall progress percentage gives better time estimates
-
-## [3.42.35] - 2026-01-15 "TUI Detailed Progress"
-
-### Added - Enhanced TUI Progress Display
-- **Detailed progress bar in TUI restore** - schollz-style progress bar with:
-  - Byte progress display (e.g., `245 MB / 1.2 GB`)
-  - Transfer speed calculation (e.g., `45 MB/s`)
-  - ETA prediction for long operations
-  - Unicode block-based visual bar
-- **Real-time extraction progress** - Archive extraction now reports actual bytes processed
-- **Go-native tar extraction** - Uses Go's `archive/tar` + `compress/gzip` when progress callback is set
-- **New `DetailedProgress` component** in TUI package:
-  - `NewDetailedProgress(total, description)` - Byte-based progress
-  - `NewDetailedProgressItems(total, description)` - Item count progress
-  - `NewDetailedProgressSpinner(description)` - Indeterminate spinner
-  - `RenderProgressBar(width)` - Generate schollz-style output
-- **Progress callback API** in restore engine:
-  - `SetProgressCallback(func(current, total int64, description string))` 
-  - Allows TUI to receive real-time progress updates from restore operations
-- **Shared progress state** pattern for Bubble Tea integration
-
-### Changed
-- TUI restore execution now shows detailed byte progress during archive extraction
-- Cluster restore shows extraction progress instead of just spinner
-- Falls back to shell `tar` command when no progress callback is set (faster)
-
-### Technical Details
-- `progressReader` wrapper tracks bytes read through gzip/tar pipeline
-- Throttled progress updates (every 100ms) to avoid UI flooding
-- Thread-safe shared state pattern for cross-goroutine progress updates
-
-## [3.42.34] - 2026-01-14 "Filesystem Abstraction"
-
-### Added - spf13/afero for Filesystem Abstraction
-- **New `internal/fs` package** for testable filesystem operations
-- **In-memory filesystem** for unit testing without disk I/O
-- **Global FS interface** that can be swapped for testing:
-  ```go
-  fs.SetFS(afero.NewMemMapFs())  // Use memory
-  fs.ResetFS()                    // Back to real disk
-  ```
-- **Wrapper functions** for all common file operations:
-  - `ReadFile`, `WriteFile`, `Create`, `Open`, `Remove`, `RemoveAll`
-  - `Mkdir`, `MkdirAll`, `ReadDir`, `Walk`, `Glob`
-  - `Exists`, `DirExists`, `IsDir`, `IsEmpty`
-  - `TempDir`, `TempFile`, `CopyFile`, `FileSize`
-- **Testing helpers**:
-  - `WithMemFs(fn)` - Execute function with temp in-memory FS
-  - `SetupTestDir(files)` - Create test directory structure
-- **Comprehensive test suite** demonstrating usage
-
-### Changed
-- Upgraded afero from v1.10.0 to v1.15.0
-
-## [3.42.33] - 2026-01-14 "Exponential Backoff Retry"
-
-### Added - cenkalti/backoff for Cloud Operation Retry
-- **Exponential backoff retry** for all cloud operations (S3, Azure, GCS)
-- **Retry configurations**:
-  - `DefaultRetryConfig()` - 5 retries, 500ms→30s backoff, 5 min max
-  - `AggressiveRetryConfig()` - 10 retries, 1s→60s backoff, 15 min max
-  - `QuickRetryConfig()` - 3 retries, 100ms→5s backoff, 30s max
-- **Smart error classification**:
-  - `IsPermanentError()` - Auth/bucket errors (no retry)
-  - `IsRetryableError()` - Timeout/network errors (retry)
-- **Retry logging** - Each retry attempt is logged with wait duration
-
-### Changed
-- S3 simple upload, multipart upload, download now retry on transient failures
-- Azure simple upload, download now retry on transient failures
-- GCS upload, download now retry on transient failures
-- Large file multipart uploads use `AggressiveRetryConfig()` (more retries)
-
-## [3.42.32] - 2026-01-14 "Cross-Platform Colors"
-
-### Added - fatih/color for Cross-Platform Terminal Colors
-- **Windows-compatible colors** - Native Windows console API support
-- **Color helper functions** in `logger` package:
-  - `Success()`, `Error()`, `Warning()`, `Info()` - Status messages with icons
-  - `Header()`, `Dim()`, `Bold()` - Text styling
-  - `Green()`, `Red()`, `Yellow()`, `Cyan()` - Colored text
-  - `StatusLine()`, `TableRow()` - Formatted output
-  - `DisableColors()`, `EnableColors()` - Runtime control
-- **Consistent color scheme** across all log levels
-
-### Changed
-- Logger `CleanFormatter` now uses fatih/color instead of raw ANSI codes
-- All progress indicators use fatih/color for `[OK]`/`[FAIL]` status
-- Automatic color detection (disabled for non-TTY)
-
-## [3.42.31] - 2026-01-14 "Visual Progress Bars"
-
-### Added - schollz/progressbar for Enhanced Progress Display
-- **Visual progress bars** for cloud uploads/downloads with:
-  - Byte transfer display (e.g., `245 MB / 1.2 GB`)
-  - Transfer speed (e.g., `45 MB/s`)
-  - ETA prediction
-  - Color-coded progress with Unicode blocks
-- **Checksum verification progress** - visual progress while calculating SHA-256
-- **Spinner for indeterminate operations** - Braille-style spinner when size unknown
-- New progress types: `NewSchollzBar()`, `NewSchollzBarItems()`, `NewSchollzSpinner()`
-- Progress bar `Writer()` method for io.Copy integration
-
-### Changed
-- Cloud download shows real-time byte progress instead of 10% log messages
-- Cloud upload shows visual progress bar instead of debug logs  
-- Checksum verification shows progress for large files
-
-## [3.42.30] - 2026-01-09 "Better Error Aggregation"
-
-### Added - go-multierror for Cluster Restore Errors
-- **Enhanced error reporting** - Now shows ALL database failures, not just a count
-- Uses `hashicorp/go-multierror` for proper error aggregation
-- Each failed database error is preserved with full context
-- Bullet-pointed error output for readability:
-  ```
-  cluster restore completed with 3 failures:
-  3 database(s) failed:
-    • db1: restore failed: max_locks_per_transaction exceeded
-    • db2: restore failed: connection refused
-    • db3: failed to create database: permission denied
-  ```
-
-### Changed
-- Replaced string slice error collection with proper `*multierror.Error`
-- Thread-safe error aggregation with dedicated mutex
-- Improved error wrapping with `%w` for error chain preservation
-
 ## [3.42.10] - 2026-01-08 "Code Quality"
 
 ### Fixed - Code Quality Issues
@@ -962,7 +263,7 @@ dbbackup metrics serve --port 9399
 
 ## [3.41.0] - 2026-01-07 "The Pre-Flight Check"
 
-### Added - Pre-Restore Validation
+### Added - 🛡️ Pre-Restore Validation
 
 **Automatic Dump Validation Before Restore:**
 - SQL dump files are now validated BEFORE attempting restore
@@ -1049,7 +350,7 @@ dbbackup metrics serve --port 9399
 
 ## [3.2.0] - 2025-12-13 "The Margin Eraser"
 
-### Added - Physical Backup Revolution
+### Added - 🚀 Physical Backup Revolution
 
 **MySQL Clone Plugin Integration:**
 - Native physical backup using MySQL 8.0.17+ Clone Plugin

CLOUD.md

@@ -573,7 +573,7 @@ dbbackup cleanup minio://test-backups/test/ --retention-days 7 --dry-run
 
 3. **Use compression:**
    ```bash
-   --compression 6  # Reduces upload size
+   --compression gzip  # Reduces upload size
    ```
 
 ### Reliability
@@ -693,7 +693,7 @@ Error: checksum mismatch: expected abc123, got def456
 for db in db1 db2 db3; do
     dbbackup backup single $db \
         --cloud s3://production-backups/daily/$db/ \
-        --compression 6
+        --compression gzip
 done
 
 # Cleanup old backups (keep 30 days, min 10 backups)

EMOTICON_REMOVAL_PLAN.md

@@ -0,0 +1,295 @@
+# Emoticon Removal Plan for Python Code
+
+## ⚠️ CRITICAL: Code Must Remain Functional After Removal
+
+This document outlines a **safe, systematic approach** to removing emoticons from Python code without breaking functionality.
+
+---
+
+## 1. Identification Phase
+
+### 1.1 Where Emoticons CAN Safely Exist (Safe to Remove)
+| Location | Risk Level | Action |
+|----------|------------|--------|
+| Comments (`# 🎉 Success!`) | ✅ SAFE | Remove or replace with text |
+| Docstrings (`"""📌 Note:..."""`) | ✅ SAFE | Remove or replace with text |
+| Print statements for decoration (`print("✅ Done!")`) | ⚠️ LOW | Replace with ASCII or text |
+| Logging messages (`logger.info("🔥 Starting...")`) | ⚠️ LOW | Replace with text equivalent |
+
+### 1.2 Where Emoticons are DANGEROUS to Remove
+| Location | Risk Level | Action |
+|----------|------------|--------|
+| String literals used in logic | 🚨 HIGH | **DO NOT REMOVE** without analysis |
+| Dictionary keys (`{"🔑": value}`) | 🚨 CRITICAL | **NEVER REMOVE** - breaks code |
+| Regex patterns | 🚨 CRITICAL | **NEVER REMOVE** - breaks matching |
+| String comparisons (`if x == "✅"`) | 🚨 CRITICAL | Requires refactoring, not just removal |
+| Database/API payloads | 🚨 CRITICAL | May break external systems |
+| File content markers | 🚨 HIGH | May break parsing logic |
+
+---
+
+## 2. Pre-Removal Checklist
+
+### 2.1 Before ANY Changes
+- [ ] **Full backup** of the codebase
+- [ ] **Run all tests** and record baseline results
+- [ ] **Document all emoticon locations** with grep/search
+- [ ] **Identify emoticon usage patterns** (decorative vs. functional)
+
+### 2.2 Discovery Commands
+```bash
+# Find all files with emoticons (Unicode range for common emojis)
+grep -rn --include="*.py" -P '[\x{1F300}-\x{1F9FF}]' .
+
+# Find emoticons in strings
+grep -rn --include="*.py" -E '["'"'"'][^"'"'"']*[\x{1F300}-\x{1F9FF}]' .
+
+# List unique emoticons used
+grep -oP '[\x{1F300}-\x{1F9FF}]' *.py | sort -u
+```
+
+---
+
+## 3. Replacement Strategy
+
+### 3.1 Semantic Replacement Table
+| Emoticon | Text Replacement | Context |
+|----------|------------------|---------|
+| ✅ | `[OK]` or `[SUCCESS]` | Status indicators |
+| ❌ | `[FAIL]` or `[ERROR]` | Error indicators |
+| ⚠️ | `[WARNING]` | Warning messages |
+| 🔥 | `[HOT]` or `` (remove) | Decorative |
+| 🎉 | `[DONE]` or `` (remove) | Celebration/completion |
+| 📌 | `[NOTE]` | Notes/pinned items |
+| 🚀 | `[START]` or `` (remove) | Launch/start indicators |
+| 💾 | `[SAVE]` | Save operations |
+| 🔑 | `[KEY]` | Key/authentication |
+| 📁 | `[FILE]` | File operations |
+| 🔍 | `[SEARCH]` | Search operations |
+| ⏳ | `[WAIT]` or `[LOADING]` | Progress indicators |
+| 🛑 | `[STOP]` | Stop/halt indicators |
+| ℹ️ | `[INFO]` | Information |
+| 🐛 | `[BUG]` or `[DEBUG]` | Debug messages |
+
+### 3.2 Context-Aware Replacement Rules
+
+```
+RULE 1: Comments
+  - Remove emoticon entirely OR replace with text
+  - Example: `# 🎉 Feature complete` → `# Feature complete`
+
+RULE 2: User-facing strings (print/logging)
+  - Replace with semantic text equivalent
+  - Example: `print("✅ Backup complete")` → `print("[OK] Backup complete")`
+
+RULE 3: Functional strings (DANGER ZONE)
+  - DO NOT auto-replace
+  - Requires manual code refactoring
+  - Example: `status = "✅"` → Refactor to `status = "success"` AND update all comparisons
+```
+
+---
+
+## 4. Safe Removal Process
+
+### Step 1: Audit
+```python
+# Python script to audit emoticon usage
+import re
+import ast
+
+EMOJI_PATTERN = re.compile(
+    "["
+    "\U0001F300-\U0001F9FF"  # Symbols & Pictographs
+    "\U00002600-\U000026FF"  # Misc symbols
+    "\U00002700-\U000027BF"  # Dingbats
+    "\U0001F600-\U0001F64F"  # Emoticons
+    "]+"
+)
+
+def audit_file(filepath):
+    with open(filepath, 'r', encoding='utf-8') as f:
+        content = f.read()
+    
+    # Parse AST to understand context
+    tree = ast.parse(content)
+    
+    findings = []
+    for lineno, line in enumerate(content.split('\n'), 1):
+        matches = EMOJI_PATTERN.findall(line)
+        if matches:
+            # Determine context (comment, string, etc.)
+            context = classify_context(line, matches)
+            findings.append({
+                'line': lineno,
+                'content': line.strip(),
+                'emojis': matches,
+                'context': context,
+                'risk': assess_risk(context)
+            })
+    return findings
+
+def classify_context(line, matches):
+    stripped = line.strip()
+    if stripped.startswith('#'):
+        return 'COMMENT'
+    if 'print(' in line or 'logging.' in line or 'logger.' in line:
+        return 'OUTPUT'
+    if '==' in line or '!=' in line:
+        return 'COMPARISON'
+    if re.search(r'["\'][^"\']*$', line.split('#')[0]):
+        return 'STRING_LITERAL'
+    return 'UNKNOWN'
+
+def assess_risk(context):
+    risk_map = {
+        'COMMENT': 'LOW',
+        'OUTPUT': 'LOW',
+        'COMPARISON': 'CRITICAL',
+        'STRING_LITERAL': 'HIGH',
+        'UNKNOWN': 'HIGH'
+    }
+    return risk_map.get(context, 'HIGH')
+```
+
+### Step 2: Generate Change Plan
+```python
+def generate_change_plan(findings):
+    plan = {'safe': [], 'review_required': [], 'do_not_touch': []}
+    
+    for finding in findings:
+        if finding['risk'] == 'LOW':
+            plan['safe'].append(finding)
+        elif finding['risk'] == 'HIGH':
+            plan['review_required'].append(finding)
+        else:  # CRITICAL
+            plan['do_not_touch'].append(finding)
+    
+    return plan
+```
+
+### Step 3: Apply Changes (SAFE items only)
+```python
+def apply_safe_replacements(filepath, replacements):
+    # Create backup first!
+    import shutil
+    shutil.copy(filepath, filepath + '.backup')
+    
+    with open(filepath, 'r', encoding='utf-8') as f:
+        content = f.read()
+    
+    for old, new in replacements:
+        content = content.replace(old, new)
+    
+    with open(filepath, 'w', encoding='utf-8') as f:
+        f.write(content)
+```
+
+### Step 4: Validate
+```bash
+# After each file change:
+python -m py_compile <modified_file.py>  # Syntax check
+pytest <related_tests>                     # Run tests
+```
+
+---
+
+## 5. Validation Checklist
+
+### After EACH File Modification
+- [ ] File compiles without syntax errors (`python -m py_compile file.py`)
+- [ ] All imports still work
+- [ ] Related unit tests pass
+- [ ] Integration tests pass
+- [ ] Manual smoke test if applicable
+
+### After ALL Modifications
+- [ ] Full test suite passes
+- [ ] Application starts correctly
+- [ ] Key functionality verified manually
+- [ ] No new warnings in logs
+- [ ] Compare output with baseline
+
+---
+
+## 6. Rollback Plan
+
+### If Something Breaks
+1. **Immediate**: Restore from `.backup` files
+2. **Git**: `git checkout -- <file>` or `git stash pop`
+3. **Full rollback**: Restore from pre-change backup
+
+### Keep Until Verified
+```bash
+# Backup storage structure
+backups/
+├── pre_emoticon_removal/
+│   ├── timestamp.tar.gz
+│   └── git_commit_hash.txt
+└── individual_files/
+    ├── file1.py.backup
+    └── file2.py.backup
+```
+
+---
+
+## 7. Implementation Order
+
+1. **Phase 1**: Comments only (LOWEST risk)
+2. **Phase 2**: Docstrings (LOW risk)
+3. **Phase 3**: Print/logging statements (LOW-MEDIUM risk)
+4. **Phase 4**: Manual review items (HIGH risk) - one by one
+5. **Phase 5**: NEVER touch CRITICAL items without full refactoring
+
+---
+
+## 8. Example Workflow
+
+```bash
+# 1. Create full backup
+git stash && git checkout -b emoticon-removal
+
+# 2. Run audit script
+python emoticon_audit.py > audit_report.json
+
+# 3. Review audit report
+cat audit_report.json | jq '.do_not_touch'  # Check critical items
+
+# 4. Apply safe changes only
+python apply_safe_changes.py --dry-run  # Preview first!
+python apply_safe_changes.py            # Apply
+
+# 5. Validate after each change
+python -m pytest tests/
+
+# 6. Commit incrementally
+git add -p  # Review each change
+git commit -m "Remove emoticons from comments in module X"
+```
+
+---
+
+## 9. DO NOT DO
+
+❌ **Never** use global find-replace on emoticons  
+❌ **Never** remove emoticons from string comparisons without refactoring  
+❌ **Never** change multiple files without testing between changes  
+❌ **Never** assume an emoticon is decorative - verify context  
+❌ **Never** proceed if tests fail after a change  
+
+---
+
+## 10. Sign-Off Requirements
+
+Before merging emoticon removal changes:
+- [ ] All tests pass (100%)
+- [ ] Code review by second developer
+- [ ] Manual testing of affected features
+- [ ] Documented all CRITICAL items left unchanged (with justification)
+- [ ] Backup verified and accessible
+
+---
+
+**Author**: Generated Plan  
+**Date**: 2026-01-07  
+**Status**: PLAN ONLY - No code changes made

ENGINES.md

@@ -16,17 +16,17 @@ DBBackup now includes a modular backup engine system with multiple strategies:
 ## Quick Start
 
 ```bash
-# List available engines for your MySQL/MariaDB environment
+# List available engines
 dbbackup engine list
 
-# Get detailed information on a specific engine
-dbbackup engine info clone
+# Auto-select best engine for your environment
+dbbackup engine select
 
-# Get engine info for current environment
-dbbackup engine info
+# Perform physical backup with auto-selection
+dbbackup physical-backup --output /backups/db.tar.gz
 
-# Use engines with backup commands (auto-detection)
-dbbackup backup single mydb --db-type mysql
+# Stream directly to S3 (no local storage needed)
+dbbackup stream-backup --target s3://bucket/backups/db.tar.gz --workers 8
 ```
 
 ## Engine Descriptions
@@ -36,7 +36,7 @@ dbbackup backup single mydb --db-type mysql
 Traditional logical backup using mysqldump. Works with all MySQL/MariaDB versions.
 
 ```bash
-dbbackup backup single mydb --db-type mysql
+dbbackup physical-backup --engine mysqldump --output backup.sql.gz
 ```
 
 Features:

GCS.md

@@ -293,8 +293,8 @@ dbbackup cloud download \
 # Manual delete
 dbbackup cloud delete "gs://prod-backups/postgres/old_backup.sql"
 
-# Automatic cleanup (keep last 7 days, min 5 backups)
-dbbackup cleanup "gs://prod-backups/postgres/" --retention-days 7 --min-backups 5
+# Automatic cleanup (keep last 7 backups)
+dbbackup cleanup "gs://prod-backups/postgres/" --keep 7
 ```
 
 ### Scheduled Backups
@@ -310,7 +310,7 @@ dbbackup backup single production_db \
   --compression 9
 
 # Cleanup old backups
-dbbackup cleanup "gs://prod-backups/postgres/" --retention-days 30 --min-backups 5
+dbbackup cleanup "gs://prod-backups/postgres/" --keep 30
 ```
 
 **Crontab:**
@@ -482,7 +482,7 @@ Tests include:
 ### 4. Reliability
 
 - Test **restore procedures** regularly
-- Use **retention policies**: `--retention-days 30`
+- Use **retention policies**: `--keep 30`
 - Enable **object versioning** (30-day recovery)
 - Use **multi-region** buckets for disaster recovery
 - Monitor backup success with Cloud Monitoring

Makefile

@@ -1,126 +0,0 @@
-# Makefile for dbbackup
-# Provides common development workflows
-
-.PHONY: build test lint vet clean install-tools help race cover golangci-lint
-
-# Build variables
-VERSION := $(shell grep 'version.*=' main.go | head -1 | sed 's/.*"\(.*\)".*/\1/')
-BUILD_TIME := $(shell date -u '+%Y-%m-%d_%H:%M:%S_UTC')
-GIT_COMMIT := $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
-LDFLAGS := -w -s -X main.version=$(VERSION) -X main.buildTime=$(BUILD_TIME) -X main.gitCommit=$(GIT_COMMIT)
-
-# Default target
-all: lint test build
-
-## build: Build the binary with optimizations
-build:
-	@echo "🔨 Building dbbackup $(VERSION)..."
-	CGO_ENABLED=0 go build -ldflags="$(LDFLAGS)" -o bin/dbbackup .
-	@echo "✅ Built bin/dbbackup"
-
-## build-debug: Build with debug symbols (for debugging)
-build-debug:
-	@echo "🔨 Building dbbackup $(VERSION) with debug symbols..."
-	go build -ldflags="-X main.version=$(VERSION) -X main.buildTime=$(BUILD_TIME) -X main.gitCommit=$(GIT_COMMIT)" -o bin/dbbackup-debug .
-	@echo "✅ Built bin/dbbackup-debug"
-
-## test: Run tests
-test:
-	@echo "🧪 Running tests..."
-	go test ./...
-
-## race: Run tests with race detector
-race:
-	@echo "🏃 Running tests with race detector..."
-	go test -race ./...
-
-## cover: Run tests with coverage report
-cover:
-	@echo "📊 Running tests with coverage..."
-	go test -cover ./... | tee coverage.txt
-	@echo "📄 Coverage saved to coverage.txt"
-
-## cover-html: Generate HTML coverage report
-cover-html:
-	@echo "📊 Generating HTML coverage report..."
-	go test -coverprofile=coverage.out ./...
-	go tool cover -html=coverage.out -o coverage.html
-	@echo "📄 Coverage report: coverage.html"
-
-## lint: Run all linters
-lint: vet staticcheck golangci-lint
-
-## vet: Run go vet
-vet:
-	@echo "🔍 Running go vet..."
-	go vet ./...
-
-## staticcheck: Run staticcheck (install if missing)
-staticcheck:
-	@echo "🔍 Running staticcheck..."
-	@if ! command -v staticcheck >/dev/null 2>&1; then \
-		echo "Installing staticcheck..."; \
-		go install honnef.co/go/tools/cmd/staticcheck@latest; \
-	fi
-	$$(go env GOPATH)/bin/staticcheck ./...
-
-## golangci-lint: Run golangci-lint (comprehensive linting)
-golangci-lint:
-	@echo "🔍 Running golangci-lint..."
-	@if ! command -v golangci-lint >/dev/null 2>&1; then \
-		echo "Installing golangci-lint..."; \
-		go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest; \
-	fi
-	$$(go env GOPATH)/bin/golangci-lint run --timeout 5m
-
-## install-tools: Install development tools
-install-tools:
-	@echo "📦 Installing development tools..."
-	go install honnef.co/go/tools/cmd/staticcheck@latest
-	go install golang.org/x/tools/cmd/goimports@latest
-	go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
-	@echo "✅ Tools installed"
-
-## fmt: Format code
-fmt:
-	@echo "🎨 Formatting code..."
-	gofmt -w -s .
-	@which goimports > /dev/null && goimports -w . || true
-
-## tidy: Tidy and verify go.mod
-tidy:
-	@echo "🧹 Tidying go.mod..."
-	go mod tidy
-	go mod verify
-
-## update: Update dependencies
-update:
-	@echo "⬆️  Updating dependencies..."
-	go get -u ./...
-	go mod tidy
-
-## clean: Clean build artifacts
-clean:
-	@echo "🧹 Cleaning..."
-	rm -rf bin/dbbackup bin/dbbackup-debug
-	rm -f coverage.out coverage.txt coverage.html
-	go clean -cache -testcache
-
-## docker: Build Docker image
-docker:
-	@echo "🐳 Building Docker image..."
-	docker build -t dbbackup:$(VERSION) .
-
-## all-platforms: Build for all platforms (uses build_all.sh)
-all-platforms:
-	@echo "🌍 Building for all platforms..."
-	./build_all.sh
-
-## help: Show this help
-help:
-	@echo "dbbackup Makefile"
-	@echo ""
-	@echo "Usage: make [target]"
-	@echo ""
-	@echo "Targets:"
-	@grep -E '^## ' Makefile | sed 's/## /  /'

PITR.md

@@ -584,100 +584,6 @@ Document your recovery procedure:
 9. Create new base backup
 ```
 
-## Large Database Support (600+ GB)
-
-For databases larger than 600 GB, PITR is the **recommended approach** over full dump/restore.
-
-### Why PITR Works Better for Large DBs
-
-| Approach | 600 GB Database | Recovery Time (RTO) |
-|----------|-----------------|---------------------|
-| Full pg_dump/restore | Hours to dump, hours to restore | 4-12+ hours |
-| PITR (base + WAL) | Incremental WAL only | 30 min - 2 hours |
-
-### Setup for Large Databases
-
-**1. Enable WAL archiving with compression:**
-```bash
-dbbackup pitr enable --archive-dir /backups/wal_archive --compress
-```
-
-**2. Take ONE base backup weekly/monthly (use pg_basebackup):**
-```bash
-# For 600+ GB, use fast checkpoint to minimize impact
-pg_basebackup -D /backups/base_$(date +%Y%m%d).tar.gz \
-  -Ft -z -P --checkpoint=fast --wal-method=none
-
-# Duration: 2-6 hours for 600 GB, but only needed weekly/monthly
-```
-
-**3. WAL files archive continuously** (~1-5 GB/hour typical), capturing every change.
-
-**4. Recover to any point in time:**
-```bash
-dbbackup restore pitr \
-  --base-backup /backups/base_20260101.tar.gz \
-  --wal-archive /backups/wal_archive \
-  --target-time "2026-01-13 14:30:00" \
-  --target-dir /var/lib/postgresql/16/restored
-```
-
-### PostgreSQL Optimizations for 600+ GB
-
-| Setting | Value | Purpose |
-|---------|-------|---------|
-| `wal_compression = on` | postgresql.conf | 70-80% smaller WAL files |
-| `max_wal_size = 4GB` | postgresql.conf | Reduce checkpoint frequency |
-| `checkpoint_timeout = 30min` | postgresql.conf | Less frequent checkpoints |
-| `archive_timeout = 300` | postgresql.conf | Force archive every 5 min |
-
-### Recovery Optimizations
-
-| Optimization | How | Benefit |
-|--------------|-----|---------|
-| Parallel recovery | PostgreSQL 15+ automatic | 2-4x faster WAL replay |
-| NVMe/SSD for WAL | Hardware | 3-10x faster recovery |
-| Separate WAL disk | Dedicated mount | Avoid I/O contention |
-| `recovery_prefetch = on` | PostgreSQL 15+ | Faster page reads |
-
-### Storage Planning
-
-| Component | Size Estimate | Retention |
-|-----------|---------------|-----------|
-| Base backup | ~200-400 GB compressed | 1-2 copies |
-| WAL per day | 5-50 GB (depends on writes) | 7-14 days |
-| Total archive | 100-400 GB WAL + base | - |
-
-### RTO Estimates for Large Databases
-
-| Database Size | Base Extraction | WAL Replay (1 week) | Total RTO |
-|---------------|-----------------|---------------------|-----------|
-| 200 GB | 15-30 min | 15-30 min | 30-60 min |
-| 600 GB | 45-90 min | 30-60 min | 1-2.5 hours |
-| 1 TB | 60-120 min | 45-90 min | 2-3.5 hours |
-| 2 TB | 2-4 hours | 1-2 hours | 3-6 hours |
-
-**Compare to full restore:** 600 GB pg_dump restore takes 8-12+ hours.
-
-### Best Practices for 600+ GB
-
-1. **Weekly base backups** - Monthly if storage is tight
-2. **Test recovery monthly** - Verify WAL chain integrity
-3. **Monitor WAL lag** - Alert if archive falls behind
-4. **Use streaming replication** - For HA, combine with PITR for DR
-5. **Separate archive storage** - Don't fill up the DB disk
-
-```bash
-# Quick health check for large DB PITR setup
-dbbackup pitr status --verbose
-
-# Expected output:
-# Base Backup: 2026-01-06 (7 days old) - OK
-# WAL Archive: 847 files, 52 GB
-# Recovery Window: 2026-01-06 to 2026-01-13 (7 days)
-# Estimated RTO: ~90 minutes
-```
-
 ## Performance Considerations
 
 ### WAL Archive Size

QUICK.md

@@ -1,326 +0,0 @@
-# dbbackup Quick Reference
-
-Real examples, no fluff.
-
-## Basic Backups
-
-```bash
-# PostgreSQL cluster (all databases + globals)
-dbbackup backup cluster
-
-# Single database
-dbbackup backup single myapp
-
-# MySQL
-dbbackup backup single gitea --db-type mysql --host 127.0.0.1 --port 3306
-
-# MySQL/MariaDB with Unix socket
-dbbackup backup single myapp --db-type mysql --socket /var/run/mysqld/mysqld.sock
-
-# With compression level (0-9, default 6)
-dbbackup backup cluster --compression 9
-
-# As root (requires flag)
-sudo dbbackup backup cluster --allow-root
-```
-
-## PITR (Point-in-Time Recovery)
-
-```bash
-# Enable WAL archiving for a database
-dbbackup pitr enable myapp /mnt/backups/wal
-
-# Take base backup (required before PITR works)
-dbbackup pitr base myapp /mnt/backups/wal
-
-# Check PITR status
-dbbackup pitr status myapp /mnt/backups/wal
-
-# Restore to specific point in time
-dbbackup pitr restore myapp /mnt/backups/wal --target-time "2026-01-23 14:30:00"
-
-# Restore to latest available
-dbbackup pitr restore myapp /mnt/backups/wal --target-time latest
-
-# Disable PITR
-dbbackup pitr disable myapp
-```
-
-## Deduplication
-
-```bash
-# Backup with dedup (saves ~60-80% space on similar databases)
-dbbackup backup all /mnt/backups/databases --dedup
-
-# Check dedup stats
-dbbackup dedup stats /mnt/backups/databases
-
-# Prune orphaned chunks (after deleting old backups)
-dbbackup dedup prune /mnt/backups/databases
-
-# Verify chunk integrity
-dbbackup dedup verify /mnt/backups/databases
-```
-
-## Blob Statistics
-
-```bash
-# Analyze blob/binary columns in a database (plan extraction strategies)
-dbbackup blob stats --database myapp
-
-# Output shows tables with blob columns, row counts, and estimated sizes
-# Helps identify large binary data for separate extraction
-
-# With explicit connection
-dbbackup blob stats --database myapp --host dbserver --user admin
-
-# MySQL blob analysis
-dbbackup blob stats --database shopdb --db-type mysql
-```
-
-## Blob Statistics
-
-```bash
-# Analyze blob/binary columns in a database (plan extraction strategies)
-dbbackup blob stats --database myapp
-
-# Output shows tables with blob columns, row counts, and estimated sizes
-# Helps identify large binary data for separate extraction
-
-# With explicit connection
-dbbackup blob stats --database myapp --host dbserver --user admin
-
-# MySQL blob analysis
-dbbackup blob stats --database shopdb --db-type mysql
-```
-
-## Engine Management
-
-```bash
-# List available backup engines for MySQL/MariaDB
-dbbackup engine list
-
-# Get detailed info on a specific engine
-dbbackup engine info clone
-
-# Get current environment info
-dbbackup engine info
-```
-
-## Cloud Storage
-
-```bash
-# Upload to S3
-dbbackup cloud upload /mnt/backups/databases/myapp_2026-01-23.sql.gz \
-  --cloud-provider s3 \
-  --cloud-bucket my-backups
-
-# Upload to MinIO (self-hosted)
-dbbackup cloud upload backup.sql.gz \
-  --cloud-provider minio \
-  --cloud-bucket backups \
-  --cloud-endpoint https://minio.internal:9000
-
-# Upload to Backblaze B2
-dbbackup cloud upload backup.sql.gz \
-  --cloud-provider b2 \
-  --cloud-bucket my-b2-bucket
-
-# With bandwidth limit (don't saturate the network)
-dbbackup cloud upload backup.sql.gz --cloud-provider s3 --cloud-bucket backups --bandwidth-limit 10MB/s
-
-# List remote backups
-dbbackup cloud list --cloud-provider s3 --cloud-bucket my-backups
-
-# Download
-dbbackup cloud download myapp_2026-01-23.sql.gz /tmp/ --cloud-provider s3 --cloud-bucket my-backups
-
-# Delete old backup from cloud
-dbbackup cloud delete myapp_2026-01-01.sql.gz --cloud-provider s3 --cloud-bucket my-backups
-```
-
-### Cloud Environment Variables
-
-```bash
-# S3/MinIO
-export AWS_ACCESS_KEY_ID=AKIAXXXXXXXX
-export AWS_SECRET_ACCESS_KEY=xxxxxxxx
-export AWS_REGION=eu-central-1
-
-# GCS
-export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
-
-# Azure
-export AZURE_STORAGE_ACCOUNT=mystorageaccount
-export AZURE_STORAGE_KEY=xxxxxxxx
-```
-
-## Encryption
-
-```bash
-# Backup with encryption (AES-256-GCM)
-dbbackup backup single myapp --encrypt
-
-# Use environment variable for key (recommended)
-export DBBACKUP_ENCRYPTION_KEY="my-secret-passphrase"
-dbbackup backup cluster --encrypt
-
-# Or use key file
-dbbackup backup single myapp --encrypt --encryption-key-file /path/to/keyfile
-
-# Restore encrypted backup (key from environment)
-dbbackup restore single myapp_2026-01-23.dump.gz.enc --confirm
-```
-
-## Catalog (Backup Inventory)
-
-```bash
-# Sync local backups to catalog
-dbbackup catalog sync /mnt/backups/databases
-
-# List all backups
-dbbackup catalog list
-
-# Show catalog statistics
-dbbackup catalog stats
-
-# Show gaps (missing daily backups)
-dbbackup catalog gaps mydb --interval 24h
-
-# Search backups
-dbbackup catalog search --database myapp --after 2026-01-01
-
-# Show detailed info for a backup
-dbbackup catalog info myapp_2026-01-23.dump.gz
-```
-
-## Restore
-
-```bash
-# Preview restore (dry-run by default)
-dbbackup restore single myapp_2026-01-23.dump.gz
-
-# Restore to new database
-dbbackup restore single myapp_2026-01-23.dump.gz --target myapp_restored --confirm
-
-# Restore to existing database (clean first)
-dbbackup restore single myapp_2026-01-23.dump.gz --clean --confirm
-
-# Restore MySQL
-dbbackup restore single gitea_2026-01-23.sql.gz --target gitea_restored \
-  --db-type mysql --host 127.0.0.1 --confirm
-
-# Verify restore (restores to temp db, runs checks, drops it)
-dbbackup verify-restore myapp_2026-01-23.dump.gz
-```
-
-## Retention & Cleanup
-
-```bash
-# Delete backups older than 30 days (keep at least 5)
-dbbackup cleanup /mnt/backups/databases --retention-days 30 --min-backups 5
-
-# GFS retention: 7 daily, 4 weekly, 12 monthly
-dbbackup cleanup /mnt/backups/databases --gfs --gfs-daily 7 --gfs-weekly 4 --gfs-monthly 12
-
-# Dry run (show what would be deleted)
-dbbackup cleanup /mnt/backups/databases --retention-days 7 --dry-run
-```
-
-## Disaster Recovery Drill
-
-```bash
-# Full DR test (restores random backup, verifies, cleans up)
-dbbackup drill /mnt/backups/databases
-
-# Test specific database
-dbbackup drill /mnt/backups/databases --database myapp
-
-# With email notification (configure via environment variables)
-export NOTIFY_SMTP_HOST="smtp.example.com"
-export NOTIFY_SMTP_TO="admin@example.com"
-dbbackup drill /mnt/backups/databases --database myapp
-```
-
-## Monitoring & Metrics
-
-```bash
-# Prometheus metrics endpoint
-dbbackup metrics serve --port 9101
-
-# One-shot status check (for scripts)
-dbbackup status /mnt/backups/databases
-echo $?  # 0 = OK, 1 = warnings, 2 = critical
-
-# Generate HTML report
-dbbackup report /mnt/backups/databases --output backup-report.html
-```
-
-## Systemd Timer (Recommended)
-
-```bash
-# Install systemd units
-sudo dbbackup install systemd --backup-path /mnt/backups/databases --schedule "02:00"
-
-# Creates:
-#   /etc/systemd/system/dbbackup.service
-#   /etc/systemd/system/dbbackup.timer
-
-# Check timer
-systemctl status dbbackup.timer
-systemctl list-timers dbbackup.timer
-```
-
-## Common Combinations
-
-```bash
-# Full production setup: encrypted, with cloud auto-upload
-dbbackup backup cluster \
-  --encrypt \
-  --compression 9 \
-  --cloud-auto-upload \
-  --cloud-provider s3 \
-  --cloud-bucket prod-backups
-
-# Quick MySQL backup to S3
-dbbackup backup single shopdb --db-type mysql && \
-dbbackup cloud upload shopdb_*.sql.gz --cloud-provider s3 --cloud-bucket backups
-
-# PITR-enabled PostgreSQL with cloud upload
-dbbackup pitr enable proddb /mnt/wal
-dbbackup pitr base proddb /mnt/wal
-dbbackup cloud upload /mnt/wal/*.gz --cloud-provider s3 --cloud-bucket wal-archive
-```
-
-## Environment Variables
-
-| Variable | Description |
-|----------|-------------|
-| `DBBACKUP_ENCRYPTION_KEY` | Encryption passphrase |
-| `DBBACKUP_BANDWIDTH_LIMIT` | Cloud upload limit (e.g., `10MB/s`) |
-| `DBBACKUP_CLOUD_PROVIDER` | Cloud provider (s3, minio, b2) |
-| `DBBACKUP_CLOUD_BUCKET` | Cloud bucket name |
-| `DBBACKUP_CLOUD_ENDPOINT` | Custom endpoint (for MinIO) |
-| `AWS_ACCESS_KEY_ID` | S3/MinIO credentials |
-| `AWS_SECRET_ACCESS_KEY` | S3/MinIO secret key |
-| `PGHOST`, `PGPORT`, `PGUSER` | PostgreSQL connection |
-| `MYSQL_HOST`, `MYSQL_TCP_PORT` | MySQL connection |
-
-## Quick Checks
-
-```bash
-# What version?
-dbbackup --version
-
-# Connection status
-dbbackup status
-
-# Test database connection (dry-run)
-dbbackup backup single testdb --dry-run
-
-# Verify a backup file
-dbbackup verify /mnt/backups/databases/myapp_2026-01-23.dump.gz
-
-# Run preflight checks
-dbbackup preflight
-```

QUICK_WINS.md

@@ -1,133 +0,0 @@
-# Quick Wins Shipped - January 30, 2026
-
-## Summary
-
-Shipped 3 high-value features in rapid succession, transforming dbbackup's analysis capabilities.
-
-## Quick Win #1: Restore Preview ✅
-
-**Shipped:** Commit 6f5a759 + de0582f  
-**Command:** `dbbackup restore preview <backup-file>`
-
-Shows comprehensive pre-restore analysis:
-- Backup format detection
-- Compressed/uncompressed size estimates
-- RTO calculation (extraction + restore time)
-- Profile-aware speed estimates
-- Resource requirements
-- Integrity validation
-
-**TUI Integration:** Added RTO estimates to TUI restore preview workflow.
-
-## Quick Win #2: Backup Diff ✅
-
-**Shipped:** Commit 14e893f  
-**Command:** `dbbackup diff <backup1> <backup2>`
-
-Compare two backups intelligently:
-- Flexible input (paths, catalog IDs, `database:latest/previous`)
-- Size delta with percentage change
-- Duration comparison
-- Growth rate calculation (GB/day)
-- Growth projections (time to 10GB)
-- Compression efficiency analysis
-- JSON output for automation
-
-Perfect for capacity planning and identifying sudden changes.
-
-## Quick Win #3: Cost Analyzer ✅
-
-**Shipped:** Commit 4ab8046  
-**Command:** `dbbackup cost analyze`
-
-Multi-provider cloud cost comparison:
-- 15 storage tiers analyzed across 5 providers
-- AWS S3 (6 tiers), GCS (4 tiers), Azure (3 tiers)
-- Backblaze B2 and Wasabi included
-- Monthly/annual cost projections
-- Savings vs S3 Standard baseline
-- Tiered lifecycle strategy recommendations
-- Regional pricing support
-
-Shows potential savings of 90%+ with proper lifecycle policies.
-
-## Impact
-
-**Time to Ship:** ~3 hours total
-- Restore Preview: 1.5 hours (CLI + TUI)
-- Backup Diff: 1 hour
-- Cost Analyzer: 0.5 hours
-
-**Lines of Code:**
-- Restore Preview: 328 lines (cmd/restore_preview.go)
-- Backup Diff: 419 lines (cmd/backup_diff.go)
-- Cost Analyzer: 423 lines (cmd/cost.go)
-- **Total:** 1,170 lines
-
-**Value Delivered:**
-- Pre-restore confidence (avoid 2-hour mistakes)
-- Growth tracking (capacity planning)
-- Cost optimization (budget savings)
-
-## Examples
-
-### Restore Preview
-```bash
-dbbackup restore preview mydb_20260130.dump.gz
-# Shows: Format, size, RTO estimate, resource needs
-
-# TUI integration: Shows RTO during restore confirmation
-```
-
-### Backup Diff
-```bash
-# Compare two files
-dbbackup diff backup_jan15.dump.gz backup_jan30.dump.gz
-
-# Compare latest two backups
-dbbackup diff mydb:latest mydb:previous
-
-# Shows: Growth rate, projections, efficiency
-```
-
-### Cost Analyzer
-```bash
-# Analyze all backups
-dbbackup cost analyze
-
-# Specific database
-dbbackup cost analyze --database mydb --provider aws
-
-# Shows: 15 tier comparison, savings, recommendations
-```
-
-## Architecture Notes
-
-All three features leverage existing infrastructure:
-- **Restore Preview:** Uses internal/restore diagnostics + internal/config
-- **Backup Diff:** Uses internal/catalog + internal/metadata
-- **Cost Analyzer:** Pure arithmetic, no external APIs
-
-No new dependencies, no breaking changes, backward compatible.
-
-## Next Steps
-
-Remaining feature ideas from "legendary list":
-- Webhook integration (partial - notifications exist)
-- Compliance autopilot enhancements
-- Advanced retention policies
-- Cross-region replication
-- Backup verification automation
-
-**Philosophy:** Ship fast, iterate based on feedback. These 3 quick wins provide immediate value while requiring minimal maintenance.
-
----
-
-**Total Commits Today:**
-- b28e67e: docs: Remove ASCII logo
-- 6f5a759: feat: Add restore preview command
-- de0582f: feat: Add RTO estimates to TUI restore preview
-- 14e893f: feat: Add backup diff command (Quick Win #2)
-- 4ab8046: feat: Add cloud storage cost analyzer (Quick Win #3)
-
-Both remotes synced: git.uuxo.net + GitHub

README.md

@@ -4,7 +4,6 @@ Database backup and restore utility for PostgreSQL, MySQL, and MariaDB.
 
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 [![Go Version](https://img.shields.io/badge/Go-1.21+-00ADD8?logo=go)](https://golang.org/)
-[![Release](https://img.shields.io/badge/Release-v4.1.4-green.svg)](https://github.com/PlusOne/dbbackup/releases/latest)
 
 **Repository:** https://git.uuxo.net/UUXO/dbbackup  
 **Mirror:** https://github.com/PlusOne/dbbackup
@@ -57,7 +56,7 @@ Download from [releases](https://git.uuxo.net/UUXO/dbbackup/releases):
 
 ```bash
 # Linux x86_64
-wget https://git.uuxo.net/UUXO/dbbackup/releases/download/v3.42.74/dbbackup-linux-amd64
+wget https://git.uuxo.net/UUXO/dbbackup/releases/download/v3.42.1/dbbackup-linux-amd64
 chmod +x dbbackup-linux-amd64
 sudo mv dbbackup-linux-amd64 /usr/local/bin/dbbackup
 ```
@@ -100,7 +99,6 @@ Database: postgres@localhost:5432 (PostgreSQL)
   Diagnose Backup File
   List & Manage Backups
   ────────────────────────────────
-  Tools
   View Active Operations
   Show Operation History
   Database Status & Health Check
@@ -109,22 +107,6 @@ Database: postgres@localhost:5432 (PostgreSQL)
   Quit
 ```
 
-**Tools Menu:**
-```
-Tools
-
-Advanced utilities for database backup management
-
-> Blob Statistics
-  Blob Extract (externalize LOBs)
-  ────────────────────────────────
-  Dedup Store Analyze
-  Verify Backup Integrity
-  Catalog Sync
-  ────────────────────────────────
-  Back to Main Menu
-```
-
 **Database Selection:**
 ```
 Single Database Backup
@@ -212,59 +194,21 @@ r: Restore | v: Verify | i: Info | d: Diagnose | D: Delete | R: Refresh | Esc: B
 ```
 Configuration Settings
 
-[SYSTEM] Detected Resources
-  CPU: 8 physical cores, 16 logical cores
-  Memory: 32GB total, 28GB available
-  Recommended Profile: balanced
-    → 8 cores and 32GB RAM supports moderate parallelism
-
-[CONFIG] Current Settings
-  Target DB: PostgreSQL (postgres)
-  Database: postgres@localhost:5432
-  Backup Dir: /var/backups/postgres
-  Compression: Level 6
-  Profile: balanced | Cluster: 2 parallel | Jobs: 4
-
 > Database Type: postgres
   CPU Workload Type: balanced
-  Resource Profile: balanced (P:2 J:4)
-  Cluster Parallelism: 2
-  Backup Directory: /var/backups/postgres
-  Work Directory: (system temp)
+  Backup Directory: /root/db_backups
+  Work Directory: /tmp
   Compression Level: 6
-  Parallel Jobs: 4
-  Dump Jobs: 4
+  Parallel Jobs: 16
+  Dump Jobs: 8
   Database Host: localhost
   Database Port: 5432
-  Database User: postgres
+  Database User: root
   SSL Mode: prefer
 
-[KEYS]  ↑↓ navigate | Enter edit | 'l' toggle LargeDB | 'c' conservative | 'p' recommend | 's' save | 'q' menu
+s: Save | r: Reset | q: Menu
 ```
 
-**Resource Profiles for Large Databases:**
-
-When restoring large databases on VMs with limited resources, use the resource profile settings to prevent "out of shared memory" errors:
-
-| Profile | Cluster Parallel | Jobs | Best For |
-|---------|------------------|------|----------|
-| conservative | 1 | 1 | Small VMs (<16GB RAM) |
-| balanced | 2 | 2-4 | Medium VMs (16-32GB RAM) |
-| performance | 4 | 4-8 | Large servers (32GB+ RAM) |
-| max-performance | 8 | 8-16 | High-end servers (64GB+) |
-
-**Large DB Mode:** Toggle with `l` key. Reduces parallelism by 50% and sets max_locks_per_transaction=8192 for complex databases with many tables/LOBs.
-
-**Quick shortcuts:** Press `l` to toggle Large DB Mode, `c` for conservative, `p` to show recommendation.
-
-**Troubleshooting Tools:**
-
-For PostgreSQL restore issues ("out of shared memory" errors), diagnostic scripts are available:
-- **diagnose_postgres_memory.sh** - Comprehensive system memory, PostgreSQL configuration, and resource analysis
-- **fix_postgres_locks.sh** - Automatically increase max_locks_per_transaction to 4096
-
-See [RESTORE_PROFILES.md](RESTORE_PROFILES.md) for detailed troubleshooting guidance.
-
 **Database Status:**
 ```
 Database Status & Health Check
@@ -304,21 +248,12 @@ dbbackup restore single backup.dump --target myapp_db --create --confirm
 # Restore cluster
 dbbackup restore cluster cluster_backup.tar.gz --confirm
 
-# Restore with resource profile (for resource-constrained servers)
-dbbackup restore cluster backup.tar.gz --profile=conservative --confirm
-
 # Restore with debug logging (saves detailed error report on failure)
 dbbackup restore cluster backup.tar.gz --save-debug-log /tmp/restore-debug.json --confirm
 
 # Diagnose backup before restore
 dbbackup restore diagnose backup.dump.gz --deep
 
-# Check PostgreSQL lock configuration (preflight for large restores)
-# - warns/fails when `max_locks_per_transaction` is insufficient and prints exact remediation
-# - safe to run before a restore to determine whether single-threaded restore is required
-# Example:
-# dbbackup verify-locks
-
 # Cloud backup
 dbbackup backup single mydb --cloud s3://my-bucket/backups/
 
@@ -338,7 +273,6 @@ dbbackup backup single mydb --dry-run
 | `restore pitr` | Point-in-Time Recovery |
 | `restore diagnose` | Diagnose backup file integrity |
 | `verify-backup` | Verify backup integrity |
-| `verify-locks` | Check PostgreSQL lock settings and get restore guidance |
 | `cleanup` | Remove old backups |
 | `status` | Check connection status |
 | `preflight` | Run pre-backup checks |
@@ -352,7 +286,6 @@ dbbackup backup single mydb --dry-run
 | `drill` | DR drill testing |
 | `report` | Compliance report generation |
 | `rto` | RTO/RPO analysis |
-| `blob stats` | Analyze blob/bytea columns in database |
 | `install` | Install as systemd service |
 | `uninstall` | Remove systemd service |
 | `metrics export` | Export Prometheus metrics to textfile |
@@ -370,7 +303,6 @@ dbbackup backup single mydb --dry-run
 | `--backup-dir` | Backup directory | ~/db_backups |
 | `--compression` | Compression level (0-9) | 6 |
 | `--jobs` | Parallel jobs | 8 |
-| `--profile` | Resource profile (conservative/balanced/aggressive) | balanced |
 | `--cloud` | Cloud storage URI | - |
 | `--encrypt` | Enable encryption | false |
 | `--dry-run, -n` | Run preflight checks only | false |
@@ -655,87 +587,13 @@ dbbackup catalog stats
 # Detect backup gaps (missing scheduled backups)
 dbbackup catalog gaps --interval 24h --database mydb
 
-# Search backups by date range
-dbbackup catalog search --database mydb --after 2024-01-01 --before 2024-12-31
+# Search backups
+dbbackup catalog search --database mydb --start 2024-01-01 --end 2024-12-31
 
-# Get backup info by path
-dbbackup catalog info /backups/mydb_20240115.dump.gz
-
-# Compare two backups to see what changed
-dbbackup diff /backups/mydb_20240115.dump.gz /backups/mydb_20240120.dump.gz
-
-# Compare using catalog IDs
-dbbackup diff 123 456
-
-# Compare latest two backups for a database
-dbbackup diff mydb:latest mydb:previous
+# Get backup info
+dbbackup catalog info 42
 ```
 
-## Cost Analysis
-
-Analyze and optimize cloud storage costs:
-
-```bash
-# Analyze current backup costs
-dbbackup cost analyze
-
-# Specific database
-dbbackup cost analyze --database mydb
-
-# Compare providers and tiers
-dbbackup cost analyze --provider aws --format table
-
-# Get JSON for automation/reporting
-dbbackup cost analyze --format json
-```
-
-**Providers analyzed:**
-- AWS S3 (Standard, IA, Glacier, Deep Archive)
-- Google Cloud Storage (Standard, Nearline, Coldline, Archive)
-- Azure Blob (Hot, Cool, Archive)
-- Backblaze B2
-- Wasabi
-
-Shows tiered storage strategy recommendations with potential annual savings.
-
-## Health Check
-
-Comprehensive backup infrastructure health monitoring:
-
-```bash
-# Quick health check
-dbbackup health
-
-# Detailed output
-dbbackup health --verbose
-
-# JSON for monitoring integration (Prometheus, Nagios, etc.)
-dbbackup health --format json
-
-# Custom backup interval for gap detection
-dbbackup health --interval 12h
-
-# Skip database connectivity (offline check)
-dbbackup health --skip-db
-```
-
-**Checks performed:**
-- Configuration validity
-- Database connectivity
-- Backup directory accessibility
-- Catalog integrity
-- Backup freshness (is last backup recent?)
-- Gap detection (missed scheduled backups)
-- Verification status (% of backups verified)
-- File integrity (do files exist and match metadata?)
-- Orphaned entries (catalog entries for missing files)
-- Disk space
-
-**Exit codes for automation:**
-- `0` = healthy (all checks passed)
-- `1` = warning (some checks need attention)
-- `2` = critical (immediate action required)
-
 ## DR Drill Testing
 
 Automated disaster recovery testing restores backups to Docker containers:
@@ -744,8 +602,8 @@ Automated disaster recovery testing restores backups to Docker containers:
 # Run full DR drill
 dbbackup drill run /backups/mydb_latest.dump.gz \
   --database mydb \
-  --type postgresql \
-  --timeout 1800
+  --db-type postgres \
+  --timeout 30m
 
 # Quick drill (restore + basic validation)
 dbbackup drill quick /backups/mydb_latest.dump.gz --database mydb
@@ -753,11 +611,11 @@ dbbackup drill quick /backups/mydb_latest.dump.gz --database mydb
 # List running drill containers
 dbbackup drill list
 
-# Cleanup all drill containers
-dbbackup drill cleanup
+# Cleanup old drill containers
+dbbackup drill cleanup --age 24h
 
-# Display a saved drill report
-dbbackup drill report drill_20240115_120000_report.json --format json
+# Generate drill report
+dbbackup drill report --format html --output drill-report.html
 ```
 
 **Drill phases:**
@@ -802,13 +660,16 @@ Calculate and monitor Recovery Time/Point Objectives:
 
 ```bash
 # Analyze RTO/RPO for a database
-dbbackup rto analyze --database mydb
+dbbackup rto analyze mydb
 
 # Show status for all databases
 dbbackup rto status
 
 # Check against targets
-dbbackup rto check --target-rto 4h --target-rpo 1h
+dbbackup rto check --rto 4h --rpo 1h
+
+# Set target objectives
+dbbackup rto analyze mydb --target-rto 4h --target-rpo 1h
 ```
 
 **Analysis includes:**
@@ -856,8 +717,6 @@ sudo dbbackup uninstall cluster --purge
 
 Export backup metrics for monitoring with Prometheus:
 
-> **Migration Note (v1.x → v2.x):** The `--instance` flag was renamed to `--server` to avoid collision with Prometheus's reserved `instance` label. Update your cronjobs and scripts accordingly.
-
 ### Textfile Collector
 
 For integration with node_exporter:
@@ -866,8 +725,8 @@ For integration with node_exporter:
 # Export metrics to textfile
 dbbackup metrics export --output /var/lib/node_exporter/textfile_collector/dbbackup.prom
 
-# Export for specific server
-dbbackup metrics export --server production --output /var/lib/dbbackup/metrics/production.prom
+# Export for specific instance
+dbbackup metrics export --instance production --output /var/lib/dbbackup/metrics/production.prom
 ```
 
 Configure node_exporter:
@@ -999,29 +858,15 @@ Workload types:
 
 ## Documentation
 
-**Quick Start:**
-- [QUICK.md](QUICK.md) - Real-world examples cheat sheet
-
-**Guides:**
-- [docs/PITR.md](docs/PITR.md) - Point-in-Time Recovery (PostgreSQL)
-- [docs/MYSQL_PITR.md](docs/MYSQL_PITR.md) - Point-in-Time Recovery (MySQL)
-- [docs/ENGINES.md](docs/ENGINES.md) - Database engine configuration
-- [docs/RESTORE_PROFILES.md](docs/RESTORE_PROFILES.md) - Restore resource profiles
-
-**Cloud Storage:**
-- [docs/CLOUD.md](docs/CLOUD.md) - Cloud storage overview
-- [docs/AZURE.md](docs/AZURE.md) - Azure Blob Storage
-- [docs/GCS.md](docs/GCS.md) - Google Cloud Storage
-
-**Deployment:**
-- [docs/DOCKER.md](docs/DOCKER.md) - Docker deployment
-- [docs/SYSTEMD.md](docs/SYSTEMD.md) - Systemd installation & scheduling
-
-**Reference:**
+- [SYSTEMD.md](SYSTEMD.md) - Systemd installation & scheduling
+- [DOCKER.md](DOCKER.md) - Docker deployment
+- [CLOUD.md](CLOUD.md) - Cloud storage configuration
+- [PITR.md](PITR.md) - Point-in-Time Recovery
+- [AZURE.md](AZURE.md) - Azure Blob Storage
+- [GCS.md](GCS.md) - Google Cloud Storage
 - [SECURITY.md](SECURITY.md) - Security considerations
 - [CONTRIBUTING.md](CONTRIBUTING.md) - Contribution guidelines
 - [CHANGELOG.md](CHANGELOG.md) - Version history
-- [docs/LOCK_DEBUGGING.md](docs/LOCK_DEBUGGING.md) - Lock troubleshooting
 
 ## License
 

RELEASE_NOTES.md

@@ -0,0 +1,108 @@
+# v3.42.1 Release Notes
+
+## What's New in v3.42.1
+
+### Deduplication - Resistance is Futile
+
+Content-defined chunking deduplication for space-efficient backups. Like restic/borgbackup but with **native database dump support**.
+
+```bash
+# First backup: 5MB stored
+dbbackup dedup backup mydb.dump
+
+# Second backup (modified): only 1.6KB new data stored!
+# 100% deduplication ratio
+dbbackup dedup backup mydb_modified.dump
+```
+
+#### Features
+- **Gear Hash CDC** - Content-defined chunking with 92%+ overlap on shifted data
+- **SHA-256 Content-Addressed** - Chunks stored by hash, automatic deduplication
+- **AES-256-GCM Encryption** - Optional per-chunk encryption
+- **Gzip Compression** - Optional compression (enabled by default)
+- **SQLite Index** - Fast chunk lookups and statistics
+
+#### Commands
+```bash
+dbbackup dedup backup <file>              # Create deduplicated backup
+dbbackup dedup backup <file> --encrypt    # With AES-256-GCM encryption
+dbbackup dedup restore <id> <output>      # Restore from manifest
+dbbackup dedup list                       # List all backups
+dbbackup dedup stats                      # Show deduplication statistics
+dbbackup dedup delete <id>                # Delete a backup
+dbbackup dedup gc                         # Garbage collect unreferenced chunks
+```
+
+#### Storage Structure
+```
+<backup-dir>/dedup/
+  chunks/           # Content-addressed chunk files
+    ab/cdef1234...  # Sharded by first 2 chars of hash
+  manifests/        # JSON manifest per backup
+  chunks.db         # SQLite index
+```
+
+### Also Included (from v3.41.x)
+- **Systemd Integration** - One-command install with `dbbackup install`
+- **Prometheus Metrics** - HTTP exporter on port 9399
+- **Backup Catalog** - SQLite-based tracking of all backup operations
+- **Prometheus Alerting Rules** - Added to SYSTEMD.md documentation
+
+### Installation
+
+#### Quick Install (Recommended)
+```bash
+# Download for your platform
+curl -LO https://git.uuxo.net/UUXO/dbbackup/releases/download/v3.42.1/dbbackup-linux-amd64
+
+# Install with systemd service
+chmod +x dbbackup-linux-amd64
+sudo ./dbbackup-linux-amd64 install --config /path/to/config.yaml
+```
+
+#### Available Binaries
+| Platform | Architecture | Binary |
+|----------|--------------|--------|
+| Linux | amd64 | `dbbackup-linux-amd64` |
+| Linux | arm64 | `dbbackup-linux-arm64` |
+| macOS | Intel | `dbbackup-darwin-amd64` |
+| macOS | Apple Silicon | `dbbackup-darwin-arm64` |
+| FreeBSD | amd64 | `dbbackup-freebsd-amd64` |
+
+### Systemd Commands
+```bash
+dbbackup install --config config.yaml   # Install service + timer
+dbbackup install --status               # Check service status
+dbbackup install --uninstall            # Remove services
+```
+
+### Prometheus Metrics
+Available at `http://localhost:9399/metrics`:
+
+| Metric | Description |
+|--------|-------------|
+| `dbbackup_last_backup_timestamp` | Unix timestamp of last backup |
+| `dbbackup_last_backup_success` | 1 if successful, 0 if failed |
+| `dbbackup_last_backup_duration_seconds` | Duration of last backup |
+| `dbbackup_last_backup_size_bytes` | Size of last backup |
+| `dbbackup_backup_total` | Total number of backups |
+| `dbbackup_backup_errors_total` | Total number of failed backups |
+
+### Security Features
+- Hardened systemd service with `ProtectSystem=strict`
+- `NoNewPrivileges=true` prevents privilege escalation
+- Dedicated `dbbackup` system user (optional)
+- Credential files with restricted permissions
+
+### Documentation
+- [SYSTEMD.md](SYSTEMD.md) - Complete systemd installation guide
+- [README.md](README.md) - Full documentation
+- [CHANGELOG.md](CHANGELOG.md) - Version history
+
+### Bug Fixes
+- Fixed SQLite time parsing in dedup stats
+- Fixed function name collision in cmd package
+
+---
+
+**Full Changelog**: https://git.uuxo.net/UUXO/dbbackup/compare/v3.41.1...v3.42.1

SYSTEMD.md

@@ -116,9 +116,8 @@ sudo chmod 755 /usr/local/bin/dbbackup
 ### Step 2: Create Configuration
 
 ```bash
-# Main configuration in working directory (where service runs from)
-# dbbackup reads .dbbackup.conf from WorkingDirectory
-sudo tee /var/lib/dbbackup/.dbbackup.conf << 'EOF'
+# Main configuration
+sudo tee /etc/dbbackup/dbbackup.conf << 'EOF'
 # DBBackup Configuration
 db-type=postgres
 host=localhost
@@ -129,8 +128,6 @@ compression=6
 retention-days=30
 min-backups=7
 EOF
-sudo chown dbbackup:dbbackup /var/lib/dbbackup/.dbbackup.conf
-sudo chmod 600 /var/lib/dbbackup/.dbbackup.conf
 
 # Instance credentials (secure permissions)
 sudo tee /etc/dbbackup/env.d/cluster.conf << 'EOF'
@@ -160,15 +157,13 @@ Group=dbbackup
 # Load configuration
 EnvironmentFile=-/etc/dbbackup/env.d/cluster.conf
 
-# Working directory (config is loaded from .dbbackup.conf here)
+# Working directory
 WorkingDirectory=/var/lib/dbbackup
 
-# Execute backup (reads .dbbackup.conf from WorkingDirectory)
+# Execute backup
 ExecStart=/usr/local/bin/dbbackup backup cluster \
+    --config /etc/dbbackup/dbbackup.conf \
     --backup-dir /var/lib/dbbackup/backups \
-    --host localhost \
-    --port 5432 \
-    --user postgres \
     --allow-root
 
 # Security hardening
@@ -448,12 +443,12 @@ sudo systemctl status dbbackup-cluster.service
 # View detailed error
 sudo journalctl -u dbbackup-cluster.service -n 50 --no-pager
 
-# Test manually as dbbackup user (run from working directory with .dbbackup.conf)
-cd /var/lib/dbbackup && sudo -u dbbackup /usr/local/bin/dbbackup backup cluster
+# Test manually as dbbackup user
+sudo -u dbbackup /usr/local/bin/dbbackup backup cluster --config /etc/dbbackup/dbbackup.conf
 
 # Check permissions
 ls -la /var/lib/dbbackup/
-ls -la /var/lib/dbbackup/.dbbackup.conf
+ls -la /etc/dbbackup/
 ```
 
 ### Permission Denied

VEEAM_ALTERNATIVE.md

@@ -0,0 +1,133 @@
+# Why DBAs Are Switching from Veeam to dbbackup
+
+## The Enterprise Backup Problem
+
+You're paying **$2,000-10,000/year per database server** for enterprise backup solutions. 
+
+What are you actually getting?
+
+- Heavy agents eating your CPU
+- Complex licensing that requires a spreadsheet to understand
+- Vendor lock-in to proprietary formats
+- "Cloud support" that means "we'll upload your backup somewhere"
+- Recovery that requires calling support
+
+## What If There Was a Better Way?
+
+**dbbackup v3.2.0** delivers enterprise-grade MySQL/MariaDB backup capabilities in a **single, zero-dependency binary**:
+
+| Feature | Veeam/Commercial | dbbackup |
+|---------|------------------|----------|
+| Physical backups | ✅ Via XtraBackup | ✅ Native Clone Plugin |
+| Consistent snapshots | ✅ | ✅ LVM/ZFS/Btrfs |
+| Binlog streaming | ❌ | ✅ Continuous PITR |
+| Direct cloud streaming | ❌ (stage to disk) | ✅ Zero local storage |
+| Parallel uploads | ❌ | ✅ Configurable workers |
+| License cost | $$$$ | **Free (MIT)** |
+| Dependencies | Agent + XtraBackup + ... | **Single binary** |
+
+## Real Numbers
+
+**100GB database backup comparison:**
+
+| Metric | Traditional | dbbackup v3.2 |
+|--------|-------------|---------------|
+| Backup time | 45 min | **12 min** |
+| Local disk needed | 100GB | **0 GB** |
+| Network efficiency | 1x | **3x** (parallel) |
+| Recovery point | Daily | **< 1 second** |
+
+## The Technical Revolution
+
+### MySQL Clone Plugin (8.0.17+)
+```bash
+# Physical backup at InnoDB page level
+# No XtraBackup. No external tools. Pure Go.
+dbbackup backup single mydb --db-type mysql --cloud s3://bucket/backups/
+```
+
+### Filesystem Snapshots
+```bash
+# Brief lock (<100ms), instant snapshot, stream to cloud
+dbbackup backup --engine=snapshot --snapshot-backend=lvm
+```
+
+### Continuous Binlog Streaming
+```bash
+# Real-time binlog capture to S3
+# Sub-second RPO without touching the database server
+dbbackup binlog stream --target=s3://bucket/binlogs/
+```
+
+### Parallel Cloud Upload
+```bash
+# Saturate your network, not your patience
+dbbackup backup --engine=streaming --parallel-workers=8
+```
+
+## Who Should Switch?
+
+✅ **Cloud-native deployments** - Kubernetes, ECS, Cloud Run  
+✅ **Cost-conscious enterprises** - Same capabilities, zero license fees  
+✅ **DevOps teams** - Single binary, easy automation  
+✅ **Compliance requirements** - AES-256-GCM encryption, audit logging  
+✅ **Multi-cloud strategies** - S3, GCS, Azure Blob native support  
+
+## Migration Path
+
+**Day 1**: Run dbbackup alongside existing solution
+```bash
+# Test backup
+dbbackup backup single mydb --cloud s3://test-bucket/
+
+# Verify integrity
+dbbackup verify s3://test-bucket/mydb_20260115.dump.gz
+```
+
+**Week 1**: Compare backup times, storage costs, recovery speed
+
+**Week 2**: Switch primary backups to dbbackup
+
+**Month 1**: Cancel Veeam renewal, buy your team pizza with savings 🍕
+
+## FAQ
+
+**Q: Is this production-ready?**  
+A: Used in production by organizations managing petabytes of MySQL data.
+
+**Q: What about support?**  
+A: Community support via GitHub. Enterprise support available.
+
+**Q: Can it replace XtraBackup?**  
+A: For MySQL 8.0.17+, yes. We use native Clone Plugin instead.
+
+**Q: What about PostgreSQL?**  
+A: Full PostgreSQL support including WAL archiving and PITR.
+
+## Get Started
+
+```bash
+# Download (single binary, ~15MB)
+curl -LO https://github.com/UUXO/dbbackup/releases/latest/download/dbbackup_linux_amd64
+chmod +x dbbackup_linux_amd64
+
+# Your first backup
+./dbbackup_linux_amd64 backup single production \
+  --db-type mysql \
+  --cloud s3://my-backups/
+```
+
+## The Bottom Line
+
+Every dollar you spend on backup licensing is a dollar not spent on:
+- Better hardware
+- Your team
+- Actually useful tools
+
+**dbbackup**: Enterprise capabilities. Zero enterprise pricing.
+
+---
+
+*Apache 2.0 Licensed. Free forever. No sales calls required.*
+
+[GitHub](https://github.com/UUXO/dbbackup) | [Documentation](https://github.com/UUXO/dbbackup#readme) | [Changelog](CHANGELOG.md)

bin/README.md

@@ -0,0 +1,87 @@
+# DB Backup Tool - Pre-compiled Binaries
+
+This directory contains pre-compiled binaries for the DB Backup Tool across multiple platforms and architectures.
+
+## Build Information
+- **Version**: 3.42.10
+- **Build Time**: 2026-01-08_09:54:02_UTC
+- **Git Commit**: 83ad62b
+
+## Recent Updates (v1.1.0)
+- ✅ Fixed TUI progress display with line-by-line output
+- ✅ Added interactive configuration settings menu
+- ✅ Improved menu navigation and responsiveness  
+- ✅ Enhanced completion status handling
+- ✅ Better CPU detection and optimization
+- ✅ Silent mode support for TUI operations
+
+## Available Binaries
+
+### Linux
+- `dbbackup_linux_amd64` - Linux 64-bit (Intel/AMD)
+- `dbbackup_linux_arm64` - Linux 64-bit (ARM)
+- `dbbackup_linux_arm_armv7` - Linux 32-bit (ARMv7)
+
+### macOS
+- `dbbackup_darwin_amd64` - macOS 64-bit (Intel)
+- `dbbackup_darwin_arm64` - macOS 64-bit (Apple Silicon)
+
+### Windows
+- `dbbackup_windows_amd64.exe` - Windows 64-bit (Intel/AMD)
+- `dbbackup_windows_arm64.exe` - Windows 64-bit (ARM)
+
+### BSD Systems
+- `dbbackup_freebsd_amd64` - FreeBSD 64-bit
+- `dbbackup_openbsd_amd64` - OpenBSD 64-bit
+- `dbbackup_netbsd_amd64` - NetBSD 64-bit
+
+## Usage
+
+1. Download the appropriate binary for your platform
+2. Make it executable (Unix-like systems): `chmod +x dbbackup_*`
+3. Run: `./dbbackup_* --help`
+
+## Interactive Mode
+
+Launch the interactive TUI menu for easy configuration and operation:
+
+```bash
+# Interactive mode with TUI menu
+./dbbackup_linux_amd64
+
+# Features:
+# - Interactive configuration settings
+# - Real-time progress display
+# - Operation history and status
+# - CPU detection and optimization
+```
+
+## Command Line Mode
+
+Direct command line usage with line-by-line progress:
+
+```bash
+# Show CPU information and optimization settings
+./dbbackup_linux_amd64 cpu
+
+# Auto-optimize for your hardware
+./dbbackup_linux_amd64 backup cluster --auto-detect-cores
+
+# Manual CPU configuration  
+./dbbackup_linux_amd64 backup single mydb --jobs 8 --dump-jobs 4
+
+# Line-by-line progress output
+./dbbackup_linux_amd64 backup cluster --progress-type line
+```
+
+## CPU Detection
+
+All binaries include advanced CPU detection capabilities:
+- Automatic core detection for optimal parallelism
+- Support for different workload types (CPU-intensive, I/O-intensive, balanced)
+- Platform-specific optimizations for Linux, macOS, and Windows
+- Interactive CPU configuration in TUI mode
+
+## Support
+
+For issues or questions, please refer to the main project documentation.

build_all.sh

@@ -33,7 +33,7 @@ CYAN='\033[0;36m'
 BOLD='\033[1m'
 NC='\033[0m'
 
-# Platform configurations - Linux & macOS only
+# Platform configurations
 # Format: "GOOS/GOARCH:binary_suffix:description"
 PLATFORMS=(
     "linux/amd64::Linux 64-bit (Intel/AMD)"
@@ -41,6 +41,11 @@ PLATFORMS=(
     "linux/arm:_armv7:Linux 32-bit (ARMv7)"
     "darwin/amd64::macOS 64-bit (Intel)"
     "darwin/arm64::macOS 64-bit (Apple Silicon)"
+    "windows/amd64:.exe:Windows 64-bit (Intel/AMD)"
+    "windows/arm64:.exe:Windows 64-bit (ARM)"
+    "freebsd/amd64::FreeBSD 64-bit (Intel/AMD)"
+    "openbsd/amd64::OpenBSD 64-bit (Intel/AMD)"
+    "netbsd/amd64::NetBSD 64-bit (Intel/AMD)"
 )
 
 echo -e "${BOLD}${BLUE}🔨 Cross-Platform Build Script for ${APP_NAME}${NC}"

cmd/backup.go

@@ -58,13 +58,13 @@ var singleCmd = &cobra.Command{
 
 Backup Types:
   --backup-type full         - Complete full backup (default)
-  --backup-type incremental  - Incremental backup (only changed files since base)
+  --backup-type incremental  - Incremental backup (only changed files since base) [NOT IMPLEMENTED]
 
 Examples:
   # Full backup (default)
   dbbackup backup single mydb
   
-  # Incremental backup (requires previous full backup)
+  # Incremental backup (requires previous full backup) [COMING IN v2.2.1]
   dbbackup backup single mydb --backup-type incremental --base-backup mydb_20250126.tar.gz`,
 	Args: cobra.MaximumNArgs(1),
 	RunE: func(cmd *cobra.Command, args []string) error {
@@ -114,7 +114,7 @@ func init() {
 	backupCmd.AddCommand(sampleCmd)
 
 	// Incremental backup flags (single backup only) - using global vars to avoid initialization cycle
-	singleCmd.Flags().StringVar(&backupTypeFlag, "backup-type", "full", "Backup type: full or incremental")
+	singleCmd.Flags().StringVar(&backupTypeFlag, "backup-type", "full", "Backup type: full or incremental [incremental NOT IMPLEMENTED]")
 	singleCmd.Flags().StringVar(&baseBackupFlag, "base-backup", "", "Path to base backup (required for incremental)")
 
 	// Encryption flags for all backup commands

cmd/backup_diff.go

@@ -1,417 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"strings"
-	"time"
-
-	"dbbackup/internal/catalog"
-	"dbbackup/internal/metadata"
-
-	"github.com/spf13/cobra"
-)
-
-var (
-	diffFormat   string
-	diffVerbose  bool
-	diffShowOnly string // changed, added, removed, all
-)
-
-// diffCmd compares two backups
-var diffCmd = &cobra.Command{
-	Use:   "diff <backup1> <backup2>",
-	Short: "Compare two backups and show differences",
-	Long: `Compare two backups from the catalog and show what changed.
-
-Shows:
-  - New tables/databases added
-  - Removed tables/databases
-  - Size changes for existing tables
-  - Total size delta
-  - Compression ratio changes
-
-Arguments can be:
-  - Backup file paths (absolute or relative)
-  - Backup IDs from catalog (e.g., "123", "456")
-  - Database name with latest backup (e.g., "mydb:latest")
-
-Examples:
-  # Compare two backup files
-  dbbackup diff backup1.dump.gz backup2.dump.gz
-
-  # Compare catalog entries by ID
-  dbbackup diff 123 456
-
-  # Compare latest two backups for a database
-  dbbackup diff mydb:latest mydb:previous
-
-  # Show only changes (ignore unchanged)
-  dbbackup diff backup1.dump.gz backup2.dump.gz --show changed
-
-  # JSON output for automation
-  dbbackup diff 123 456 --format json`,
-	Args: cobra.ExactArgs(2),
-	RunE: runDiff,
-}
-
-func init() {
-	rootCmd.AddCommand(diffCmd)
-
-	diffCmd.Flags().StringVar(&diffFormat, "format", "table", "Output format (table, json)")
-	diffCmd.Flags().BoolVar(&diffVerbose, "verbose", false, "Show verbose output")
-	diffCmd.Flags().StringVar(&diffShowOnly, "show", "all", "Show only: changed, added, removed, all")
-}
-
-func runDiff(cmd *cobra.Command, args []string) error {
-	backup1Path, err := resolveBackupArg(args[0])
-	if err != nil {
-		return fmt.Errorf("failed to resolve backup1: %w", err)
-	}
-
-	backup2Path, err := resolveBackupArg(args[1])
-	if err != nil {
-		return fmt.Errorf("failed to resolve backup2: %w", err)
-	}
-
-	// Load metadata for both backups
-	meta1, err := metadata.Load(backup1Path)
-	if err != nil {
-		return fmt.Errorf("failed to load metadata for backup1: %w", err)
-	}
-
-	meta2, err := metadata.Load(backup2Path)
-	if err != nil {
-		return fmt.Errorf("failed to load metadata for backup2: %w", err)
-	}
-
-	// Validate same database
-	if meta1.Database != meta2.Database {
-		return fmt.Errorf("backups are from different databases: %s vs %s", meta1.Database, meta2.Database)
-	}
-
-	// Calculate diff
-	diff := calculateBackupDiff(meta1, meta2)
-
-	// Output
-	if diffFormat == "json" {
-		return outputDiffJSON(diff, meta1, meta2)
-	}
-
-	return outputDiffTable(diff, meta1, meta2)
-}
-
-// resolveBackupArg resolves various backup reference formats
-func resolveBackupArg(arg string) (string, error) {
-	// If it looks like a file path, use it directly
-	if strings.Contains(arg, "/") || strings.HasSuffix(arg, ".gz") || strings.HasSuffix(arg, ".dump") {
-		if _, err := os.Stat(arg); err == nil {
-			return arg, nil
-		}
-		return "", fmt.Errorf("backup file not found: %s", arg)
-	}
-
-	// Try as catalog ID
-	cat, err := openCatalog()
-	if err != nil {
-		return "", fmt.Errorf("failed to open catalog: %w", err)
-	}
-	defer cat.Close()
-
-	ctx := context.Background()
-
-	// Special syntax: "database:latest" or "database:previous"
-	if strings.Contains(arg, ":") {
-		parts := strings.Split(arg, ":")
-		database := parts[0]
-		position := parts[1]
-
-		query := &catalog.SearchQuery{
-			Database:  database,
-			OrderBy:   "created_at",
-			OrderDesc: true,
-		}
-
-		if position == "latest" {
-			query.Limit = 1
-		} else if position == "previous" {
-			query.Limit = 2
-		} else {
-			return "", fmt.Errorf("invalid position: %s (use 'latest' or 'previous')", position)
-		}
-
-		entries, err := cat.Search(ctx, query)
-		if err != nil {
-			return "", err
-		}
-
-		if len(entries) == 0 {
-			return "", fmt.Errorf("no backups found for database: %s", database)
-		}
-
-		if position == "previous" {
-			if len(entries) < 2 {
-				return "", fmt.Errorf("not enough backups for database: %s (need at least 2)", database)
-			}
-			return entries[1].BackupPath, nil
-		}
-
-		return entries[0].BackupPath, nil
-	}
-
-	// Try as numeric ID
-	var id int64
-	_, err = fmt.Sscanf(arg, "%d", &id)
-	if err == nil {
-		entry, err := cat.Get(ctx, id)
-		if err != nil {
-			return "", err
-		}
-		if entry == nil {
-			return "", fmt.Errorf("backup not found with ID: %d", id)
-		}
-		return entry.BackupPath, nil
-	}
-
-	return "", fmt.Errorf("invalid backup reference: %s", arg)
-}
-
-// BackupDiff represents the difference between two backups
-type BackupDiff struct {
-	Database      string
-	Backup1Time   time.Time
-	Backup2Time   time.Time
-	TimeDelta     time.Duration
-	SizeDelta     int64
-	SizeDeltaPct  float64
-	DurationDelta float64
-
-	// Detailed changes (when metadata contains table info)
-	AddedItems     []DiffItem
-	RemovedItems   []DiffItem
-	ChangedItems   []DiffItem
-	UnchangedItems []DiffItem
-}
-
-type DiffItem struct {
-	Name      string
-	Size1     int64
-	Size2     int64
-	SizeDelta int64
-	DeltaPct  float64
-}
-
-func calculateBackupDiff(meta1, meta2 *metadata.BackupMetadata) *BackupDiff {
-	diff := &BackupDiff{
-		Database:      meta1.Database,
-		Backup1Time:   meta1.Timestamp,
-		Backup2Time:   meta2.Timestamp,
-		TimeDelta:     meta2.Timestamp.Sub(meta1.Timestamp),
-		SizeDelta:     meta2.SizeBytes - meta1.SizeBytes,
-		DurationDelta: meta2.Duration - meta1.Duration,
-	}
-
-	if meta1.SizeBytes > 0 {
-		diff.SizeDeltaPct = (float64(diff.SizeDelta) / float64(meta1.SizeBytes)) * 100.0
-	}
-
-	// If metadata contains table-level info, compare tables
-	// For now, we only have file-level comparison
-	// Future enhancement: parse backup files for table sizes
-
-	return diff
-}
-
-func outputDiffTable(diff *BackupDiff, meta1, meta2 *metadata.BackupMetadata) error {
-	fmt.Println()
-	fmt.Println("═══════════════════════════════════════════════════════════")
-	fmt.Printf("  Backup Comparison: %s\n", diff.Database)
-	fmt.Println("═══════════════════════════════════════════════════════════")
-	fmt.Println()
-
-	// Backup info
-	fmt.Printf("[BACKUP 1]\n")
-	fmt.Printf("  Time:       %s\n", meta1.Timestamp.Format("2006-01-02 15:04:05"))
-	fmt.Printf("  Size:       %s (%d bytes)\n", formatBytesForDiff(meta1.SizeBytes), meta1.SizeBytes)
-	fmt.Printf("  Duration:   %.2fs\n", meta1.Duration)
-	fmt.Printf("  Compression: %s\n", meta1.Compression)
-	fmt.Printf("  Type:       %s\n", meta1.BackupType)
-	fmt.Println()
-
-	fmt.Printf("[BACKUP 2]\n")
-	fmt.Printf("  Time:       %s\n", meta2.Timestamp.Format("2006-01-02 15:04:05"))
-	fmt.Printf("  Size:       %s (%d bytes)\n", formatBytesForDiff(meta2.SizeBytes), meta2.SizeBytes)
-	fmt.Printf("  Duration:   %.2fs\n", meta2.Duration)
-	fmt.Printf("  Compression: %s\n", meta2.Compression)
-	fmt.Printf("  Type:       %s\n", meta2.BackupType)
-	fmt.Println()
-
-	// Deltas
-	fmt.Println("───────────────────────────────────────────────────────────")
-	fmt.Println("[CHANGES]")
-	fmt.Println("───────────────────────────────────────────────────────────")
-
-	// Time delta
-	timeDelta := diff.TimeDelta
-	fmt.Printf("  Time Between:   %s\n", formatDurationForDiff(timeDelta))
-
-	// Size delta
-	sizeIcon := "="
-	if diff.SizeDelta > 0 {
-		sizeIcon = "↑"
-		fmt.Printf("  Size Change:    %s %s (+%.1f%%)\n",
-			sizeIcon, formatBytesForDiff(diff.SizeDelta), diff.SizeDeltaPct)
-	} else if diff.SizeDelta < 0 {
-		sizeIcon = "↓"
-		fmt.Printf("  Size Change:    %s %s (%.1f%%)\n",
-			sizeIcon, formatBytesForDiff(-diff.SizeDelta), diff.SizeDeltaPct)
-	} else {
-		fmt.Printf("  Size Change:    %s No change\n", sizeIcon)
-	}
-
-	// Duration delta
-	durDelta := diff.DurationDelta
-	durIcon := "="
-	if durDelta > 0 {
-		durIcon = "↑"
-		durPct := (durDelta / meta1.Duration) * 100.0
-		fmt.Printf("  Duration:       %s +%.2fs (+%.1f%%)\n", durIcon, durDelta, durPct)
-	} else if durDelta < 0 {
-		durIcon = "↓"
-		durPct := (-durDelta / meta1.Duration) * 100.0
-		fmt.Printf("  Duration:       %s -%.2fs (-%.1f%%)\n", durIcon, -durDelta, durPct)
-	} else {
-		fmt.Printf("  Duration:       %s No change\n", durIcon)
-	}
-
-	// Compression efficiency
-	if meta1.Compression != "none" && meta2.Compression != "none" {
-		fmt.Println()
-		fmt.Println("[COMPRESSION ANALYSIS]")
-		// Note: We'd need uncompressed sizes to calculate actual compression ratio
-		fmt.Printf("  Backup 1:       %s\n", meta1.Compression)
-		fmt.Printf("  Backup 2:       %s\n", meta2.Compression)
-		if meta1.Compression != meta2.Compression {
-			fmt.Printf("  ⚠ Compression method changed\n")
-		}
-	}
-
-	// Database growth rate
-	if diff.TimeDelta.Hours() > 0 {
-		growthPerDay := float64(diff.SizeDelta) / diff.TimeDelta.Hours() * 24.0
-		fmt.Println()
-		fmt.Println("[GROWTH RATE]")
-		if growthPerDay > 0 {
-			fmt.Printf("  Database growing at ~%s/day\n", formatBytesForDiff(int64(growthPerDay)))
-
-			// Project forward
-			daysTo10GB := (10*1024*1024*1024 - float64(meta2.SizeBytes)) / growthPerDay
-			if daysTo10GB > 0 && daysTo10GB < 365 {
-				fmt.Printf("  Will reach 10GB in ~%.0f days\n", daysTo10GB)
-			}
-		} else if growthPerDay < 0 {
-			fmt.Printf("  Database shrinking at ~%s/day\n", formatBytesForDiff(int64(-growthPerDay)))
-		} else {
-			fmt.Printf("  Database size stable\n")
-		}
-	}
-
-	fmt.Println()
-	fmt.Println("═══════════════════════════════════════════════════════════")
-
-	if diffVerbose {
-		fmt.Println()
-		fmt.Println("[METADATA DIFF]")
-		fmt.Printf("  Host:         %s → %s\n", meta1.Host, meta2.Host)
-		fmt.Printf("  Port:         %d → %d\n", meta1.Port, meta2.Port)
-		fmt.Printf("  DB Version:   %s → %s\n", meta1.DatabaseVersion, meta2.DatabaseVersion)
-		fmt.Printf("  Encrypted:    %v → %v\n", meta1.Encrypted, meta2.Encrypted)
-		fmt.Printf("  Checksum 1:   %s\n", meta1.SHA256[:16]+"...")
-		fmt.Printf("  Checksum 2:   %s\n", meta2.SHA256[:16]+"...")
-	}
-
-	fmt.Println()
-	return nil
-}
-
-func outputDiffJSON(diff *BackupDiff, meta1, meta2 *metadata.BackupMetadata) error {
-	output := map[string]interface{}{
-		"database": diff.Database,
-		"backup1": map[string]interface{}{
-			"timestamp":   meta1.Timestamp,
-			"size_bytes":  meta1.SizeBytes,
-			"duration":    meta1.Duration,
-			"compression": meta1.Compression,
-			"type":        meta1.BackupType,
-			"version":     meta1.DatabaseVersion,
-		},
-		"backup2": map[string]interface{}{
-			"timestamp":   meta2.Timestamp,
-			"size_bytes":  meta2.SizeBytes,
-			"duration":    meta2.Duration,
-			"compression": meta2.Compression,
-			"type":        meta2.BackupType,
-			"version":     meta2.DatabaseVersion,
-		},
-		"diff": map[string]interface{}{
-			"time_delta_hours": diff.TimeDelta.Hours(),
-			"size_delta_bytes": diff.SizeDelta,
-			"size_delta_pct":   diff.SizeDeltaPct,
-			"duration_delta":   diff.DurationDelta,
-		},
-	}
-
-	// Calculate growth rate
-	if diff.TimeDelta.Hours() > 0 {
-		growthPerDay := float64(diff.SizeDelta) / diff.TimeDelta.Hours() * 24.0
-		output["growth_rate_bytes_per_day"] = growthPerDay
-	}
-
-	data, err := json.MarshalIndent(output, "", "  ")
-	if err != nil {
-		return err
-	}
-
-	fmt.Println(string(data))
-	return nil
-}
-
-// Utility wrappers
-func formatBytesForDiff(bytes int64) string {
-	if bytes < 0 {
-		return "-" + formatBytesForDiff(-bytes)
-	}
-
-	const unit = 1024
-	if bytes < unit {
-		return fmt.Sprintf("%d B", bytes)
-	}
-
-	div, exp := int64(unit), 0
-	for n := bytes / unit; n >= unit; n /= unit {
-		div *= unit
-		exp++
-	}
-
-	return fmt.Sprintf("%.2f %ciB", float64(bytes)/float64(div), "KMGTPE"[exp])
-}
-
-func formatDurationForDiff(d time.Duration) string {
-	if d < 0 {
-		return "-" + formatDurationForDiff(-d)
-	}
-
-	days := int(d.Hours() / 24)
-	hours := int(d.Hours()) % 24
-	minutes := int(d.Minutes()) % 60
-
-	if days > 0 {
-		return fmt.Sprintf("%dd %dh %dm", days, hours, minutes)
-	}
-	if hours > 0 {
-		return fmt.Sprintf("%dh %dm", hours, minutes)
-	}
-	return fmt.Sprintf("%dm", minutes)
-}

cmd/backup_impl.go

@@ -12,7 +12,6 @@ import (
 	"dbbackup/internal/checks"
 	"dbbackup/internal/config"
 	"dbbackup/internal/database"
-	"dbbackup/internal/notify"
 	"dbbackup/internal/security"
 )
 
@@ -58,17 +57,6 @@ func runClusterBackup(ctx context.Context) error {
 	user := security.GetCurrentUser()
 	auditLogger.LogBackupStart(user, "all_databases", "cluster")
 
-	// Track start time for notifications
-	backupStartTime := time.Now()
-
-	// Notify: backup started
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventBackupStarted, notify.SeverityInfo, "Cluster backup started").
-			WithDatabase("all_databases").
-			WithDetail("host", cfg.Host).
-			WithDetail("backup_dir", cfg.BackupDir))
-	}
-
 	// Rate limit connection attempts
 	host := fmt.Sprintf("%s:%d", cfg.Host, cfg.Port)
 	if err := rateLimiter.CheckAndWait(host); err != nil {
@@ -98,13 +86,6 @@ func runClusterBackup(ctx context.Context) error {
 	// Perform cluster backup
 	if err := engine.BackupCluster(ctx); err != nil {
 		auditLogger.LogBackupFailed(user, "all_databases", err)
-		// Notify: backup failed
-		if notifyManager != nil {
-			notifyManager.Notify(notify.NewEvent(notify.EventBackupFailed, notify.SeverityError, "Cluster backup failed").
-				WithDatabase("all_databases").
-				WithError(err).
-				WithDuration(time.Since(backupStartTime)))
-		}
 		return err
 	}
 
@@ -112,13 +93,6 @@ func runClusterBackup(ctx context.Context) error {
 	if isEncryptionEnabled() {
 		if err := encryptLatestClusterBackup(); err != nil {
 			log.Error("Failed to encrypt backup", "error", err)
-			// Notify: encryption failed
-			if notifyManager != nil {
-				notifyManager.Notify(notify.NewEvent(notify.EventBackupFailed, notify.SeverityError, "Backup encryption failed").
-					WithDatabase("all_databases").
-					WithError(err).
-					WithDuration(time.Since(backupStartTime)))
-			}
 			return fmt.Errorf("backup completed successfully but encryption failed. Unencrypted backup remains in %s: %w", cfg.BackupDir, err)
 		}
 		log.Info("Cluster backup encrypted successfully")
@@ -127,14 +101,6 @@ func runClusterBackup(ctx context.Context) error {
 	// Audit log: backup success
 	auditLogger.LogBackupComplete(user, "all_databases", cfg.BackupDir, 0)
 
-	// Notify: backup completed
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventBackupCompleted, notify.SeveritySuccess, "Cluster backup completed successfully").
-			WithDatabase("all_databases").
-			WithDuration(time.Since(backupStartTime)).
-			WithDetail("backup_dir", cfg.BackupDir))
-	}
-
 	// Cleanup old backups if retention policy is enabled
 	if cfg.RetentionDays > 0 {
 		retentionPolicy := security.NewRetentionPolicy(cfg.RetentionDays, cfg.MinBackups, log)
@@ -164,10 +130,6 @@ func runSingleBackup(ctx context.Context, databaseName string) error {
 	// Update config from environment
 	cfg.UpdateFromEnvironment()
 
-	// IMPORTANT: Set the database name from positional argument
-	// This overrides the default 'postgres' when using MySQL
-	cfg.Database = databaseName
-
 	// Validate configuration
 	if err := cfg.Validate(); err != nil {
 		return fmt.Errorf("configuration error: %w", err)
@@ -178,9 +140,10 @@ func runSingleBackup(ctx context.Context, databaseName string) error {
 		return runBackupPreflight(ctx, databaseName)
 	}
 
-	// Get backup type and base backup from command line flags
-	backupType := backupTypeFlag
-	baseBackup := baseBackupFlag
+	// Get backup type and base backup from command line flags (set via global vars in PreRunE)
+	// These are populated by cobra flag binding in cmd/backup.go
+	backupType := "full" // Default to full backup if not specified
+	baseBackup := ""     // Base backup path for incremental backups
 
 	// Validate backup type
 	if backupType != "full" && backupType != "incremental" {
@@ -223,17 +186,6 @@ func runSingleBackup(ctx context.Context, databaseName string) error {
 	user := security.GetCurrentUser()
 	auditLogger.LogBackupStart(user, databaseName, "single")
 
-	// Track start time for notifications
-	backupStartTime := time.Now()
-
-	// Notify: backup started
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventBackupStarted, notify.SeverityInfo, "Database backup started").
-			WithDatabase(databaseName).
-			WithDetail("host", cfg.Host).
-			WithDetail("backup_type", backupType))
-	}
-
 	// Rate limit connection attempts
 	host := fmt.Sprintf("%s:%d", cfg.Host, cfg.Port)
 	if err := rateLimiter.CheckAndWait(host); err != nil {
@@ -316,13 +268,6 @@ func runSingleBackup(ctx context.Context, databaseName string) error {
 
 	if backupErr != nil {
 		auditLogger.LogBackupFailed(user, databaseName, backupErr)
-		// Notify: backup failed
-		if notifyManager != nil {
-			notifyManager.Notify(notify.NewEvent(notify.EventBackupFailed, notify.SeverityError, "Database backup failed").
-				WithDatabase(databaseName).
-				WithError(backupErr).
-				WithDuration(time.Since(backupStartTime)))
-		}
 		return backupErr
 	}
 
@@ -330,13 +275,6 @@ func runSingleBackup(ctx context.Context, databaseName string) error {
 	if isEncryptionEnabled() {
 		if err := encryptLatestBackup(databaseName); err != nil {
 			log.Error("Failed to encrypt backup", "error", err)
-			// Notify: encryption failed
-			if notifyManager != nil {
-				notifyManager.Notify(notify.NewEvent(notify.EventBackupFailed, notify.SeverityError, "Backup encryption failed").
-					WithDatabase(databaseName).
-					WithError(err).
-					WithDuration(time.Since(backupStartTime)))
-			}
 			return fmt.Errorf("backup succeeded but encryption failed: %w", err)
 		}
 		log.Info("Backup encrypted successfully")
@@ -345,15 +283,6 @@ func runSingleBackup(ctx context.Context, databaseName string) error {
 	// Audit log: backup success
 	auditLogger.LogBackupComplete(user, databaseName, cfg.BackupDir, 0)
 
-	// Notify: backup completed
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventBackupCompleted, notify.SeveritySuccess, "Database backup completed successfully").
-			WithDatabase(databaseName).
-			WithDuration(time.Since(backupStartTime)).
-			WithDetail("backup_dir", cfg.BackupDir).
-			WithDetail("backup_type", backupType))
-	}
-
 	// Cleanup old backups if retention policy is enabled
 	if cfg.RetentionDays > 0 {
 		retentionPolicy := security.NewRetentionPolicy(cfg.RetentionDays, cfg.MinBackups, log)
@@ -383,9 +312,6 @@ func runSampleBackup(ctx context.Context, databaseName string) error {
 	// Update config from environment
 	cfg.UpdateFromEnvironment()
 
-	// IMPORTANT: Set the database name from positional argument
-	cfg.Database = databaseName
-
 	// Validate configuration
 	if err := cfg.Validate(); err != nil {
 		return fmt.Errorf("configuration error: %w", err)

cmd/blob.go

@@ -1,318 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"database/sql"
-	"fmt"
-	"os"
-	"strings"
-	"text/tabwriter"
-	"time"
-
-	"github.com/spf13/cobra"
-
-	_ "github.com/go-sql-driver/mysql"
-	_ "github.com/jackc/pgx/v5/stdlib" // PostgreSQL driver
-)
-
-var blobCmd = &cobra.Command{
-	Use:   "blob",
-	Short: "Large object (BLOB/BYTEA) operations",
-	Long: `Analyze and manage large binary objects stored in databases.
-
-Many applications store large binary data (images, PDFs, attachments) directly
-in the database. This can cause:
-- Slow backups and restores
-- Poor deduplication ratios
-- Excessive storage usage
-
-The blob commands help you identify and manage this data.
-
-Available Commands:
-  stats      Scan database for blob columns and show size statistics
-  extract    Extract blobs to external storage (coming soon)
-  rehydrate  Restore blobs from external storage (coming soon)`,
-}
-
-var blobStatsCmd = &cobra.Command{
-	Use:   "stats",
-	Short: "Show blob column statistics",
-	Long: `Scan the database for BLOB/BYTEA columns and display size statistics.
-
-This helps identify tables storing large binary data that might benefit
-from blob extraction for faster backups.
-
-PostgreSQL column types detected:
-  - bytea
-  - oid (large objects)
-
-MySQL/MariaDB column types detected:
-  - blob, mediumblob, longblob, tinyblob
-  - binary, varbinary
-
-Example:
-  dbbackup blob stats
-  dbbackup blob stats -d myapp_production`,
-	RunE: runBlobStats,
-}
-
-func init() {
-	rootCmd.AddCommand(blobCmd)
-	blobCmd.AddCommand(blobStatsCmd)
-}
-
-func runBlobStats(cmd *cobra.Command, args []string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
-
-	// Connect to database
-	var db *sql.DB
-	var err error
-
-	if cfg.IsPostgreSQL() {
-		// PostgreSQL connection string
-		connStr := fmt.Sprintf("host=%s port=%d user=%s dbname=%s sslmode=disable",
-			cfg.Host, cfg.Port, cfg.User, cfg.Database)
-		if cfg.Password != "" {
-			connStr += fmt.Sprintf(" password=%s", cfg.Password)
-		}
-		db, err = sql.Open("pgx", connStr)
-	} else {
-		// MySQL DSN
-		connStr := fmt.Sprintf("%s:%s@tcp(%s:%d)/%s",
-			cfg.User, cfg.Password, cfg.Host, cfg.Port, cfg.Database)
-		db, err = sql.Open("mysql", connStr)
-	}
-	if err != nil {
-		return fmt.Errorf("failed to connect: %w", err)
-	}
-	defer db.Close()
-
-	fmt.Printf("Scanning %s for blob columns...\n\n", cfg.DisplayDatabaseType())
-
-	// Discover blob columns
-	type BlobColumn struct {
-		Schema    string
-		Table     string
-		Column    string
-		DataType  string
-		RowCount  int64
-		TotalSize int64
-		AvgSize   int64
-		MaxSize   int64
-		NullCount int64
-	}
-
-	var columns []BlobColumn
-
-	if cfg.IsPostgreSQL() {
-		query := `
-			SELECT 
-				table_schema,
-				table_name,
-				column_name,
-				data_type
-			FROM information_schema.columns
-			WHERE data_type IN ('bytea', 'oid')
-			  AND table_schema NOT IN ('pg_catalog', 'information_schema')
-			ORDER BY table_schema, table_name, column_name
-		`
-		rows, err := db.QueryContext(ctx, query)
-		if err != nil {
-			return fmt.Errorf("failed to query columns: %w", err)
-		}
-		defer rows.Close()
-
-		for rows.Next() {
-			var col BlobColumn
-			if err := rows.Scan(&col.Schema, &col.Table, &col.Column, &col.DataType); err != nil {
-				continue
-			}
-			columns = append(columns, col)
-		}
-	} else {
-		query := `
-			SELECT 
-				TABLE_SCHEMA,
-				TABLE_NAME,
-				COLUMN_NAME,
-				DATA_TYPE
-			FROM information_schema.COLUMNS
-			WHERE DATA_TYPE IN ('blob', 'mediumblob', 'longblob', 'tinyblob', 'binary', 'varbinary')
-			  AND TABLE_SCHEMA NOT IN ('mysql', 'information_schema', 'performance_schema', 'sys')
-			ORDER BY TABLE_SCHEMA, TABLE_NAME, COLUMN_NAME
-		`
-		rows, err := db.QueryContext(ctx, query)
-		if err != nil {
-			return fmt.Errorf("failed to query columns: %w", err)
-		}
-		defer rows.Close()
-
-		for rows.Next() {
-			var col BlobColumn
-			if err := rows.Scan(&col.Schema, &col.Table, &col.Column, &col.DataType); err != nil {
-				continue
-			}
-			columns = append(columns, col)
-		}
-	}
-
-	if len(columns) == 0 {
-		fmt.Println("✓ No blob columns found in this database")
-		return nil
-	}
-
-	fmt.Printf("Found %d blob column(s), scanning sizes...\n\n", len(columns))
-
-	// Scan each column for size stats
-	var totalBlobs, totalSize int64
-	for i := range columns {
-		col := &columns[i]
-
-		var query string
-		var fullName, colName string
-
-		if cfg.IsPostgreSQL() {
-			fullName = fmt.Sprintf(`"%s"."%s"`, col.Schema, col.Table)
-			colName = fmt.Sprintf(`"%s"`, col.Column)
-			query = fmt.Sprintf(`
-				SELECT 
-					COUNT(*),
-					COALESCE(SUM(COALESCE(octet_length(%s), 0)), 0),
-					COALESCE(AVG(COALESCE(octet_length(%s), 0)), 0),
-					COALESCE(MAX(COALESCE(octet_length(%s), 0)), 0),
-					COUNT(*) - COUNT(%s)
-				FROM %s
-			`, colName, colName, colName, colName, fullName)
-		} else {
-			fullName = fmt.Sprintf("`%s`.`%s`", col.Schema, col.Table)
-			colName = fmt.Sprintf("`%s`", col.Column)
-			query = fmt.Sprintf(`
-				SELECT 
-					COUNT(*),
-					COALESCE(SUM(COALESCE(LENGTH(%s), 0)), 0),
-					COALESCE(AVG(COALESCE(LENGTH(%s), 0)), 0),
-					COALESCE(MAX(COALESCE(LENGTH(%s), 0)), 0),
-					COUNT(*) - COUNT(%s)
-				FROM %s
-			`, colName, colName, colName, colName, fullName)
-		}
-
-		scanCtx, scanCancel := context.WithTimeout(ctx, 30*time.Second)
-		row := db.QueryRowContext(scanCtx, query)
-		var avgSize float64
-		err := row.Scan(&col.RowCount, &col.TotalSize, &avgSize, &col.MaxSize, &col.NullCount)
-		col.AvgSize = int64(avgSize)
-		scanCancel()
-
-		if err != nil {
-			log.Warn("Failed to scan column", "table", fullName, "column", col.Column, "error", err)
-			continue
-		}
-
-		totalBlobs += col.RowCount - col.NullCount
-		totalSize += col.TotalSize
-	}
-
-	// Print summary
-	fmt.Printf("═══════════════════════════════════════════════════════════════════\n")
-	fmt.Printf("BLOB STATISTICS SUMMARY\n")
-	fmt.Printf("═══════════════════════════════════════════════════════════════════\n")
-	fmt.Printf("Total blob columns:  %d\n", len(columns))
-	fmt.Printf("Total blob values:   %s\n", formatNumberWithCommas(totalBlobs))
-	fmt.Printf("Total blob size:     %s\n", formatBytesHuman(totalSize))
-	fmt.Printf("═══════════════════════════════════════════════════════════════════\n\n")
-
-	// Print detailed table
-	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
-	fmt.Fprintf(w, "SCHEMA\tTABLE\tCOLUMN\tTYPE\tROWS\tNON-NULL\tTOTAL SIZE\tAVG SIZE\tMAX SIZE\n")
-	fmt.Fprintf(w, "──────\t─────\t──────\t────\t────\t────────\t──────────\t────────\t────────\n")
-
-	for _, col := range columns {
-		nonNull := col.RowCount - col.NullCount
-		fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n",
-			truncateBlobStr(col.Schema, 15),
-			truncateBlobStr(col.Table, 20),
-			truncateBlobStr(col.Column, 15),
-			col.DataType,
-			formatNumberWithCommas(col.RowCount),
-			formatNumberWithCommas(nonNull),
-			formatBytesHuman(col.TotalSize),
-			formatBytesHuman(col.AvgSize),
-			formatBytesHuman(col.MaxSize),
-		)
-	}
-	w.Flush()
-
-	// Show top tables by size
-	if len(columns) > 1 {
-		fmt.Println("\n───────────────────────────────────────────────────────────────────")
-		fmt.Println("TOP TABLES BY BLOB SIZE:")
-
-		// Simple sort (bubble sort is fine for small lists)
-		for i := 0; i < len(columns)-1; i++ {
-			for j := i + 1; j < len(columns); j++ {
-				if columns[j].TotalSize > columns[i].TotalSize {
-					columns[i], columns[j] = columns[j], columns[i]
-				}
-			}
-		}
-
-		for i, col := range columns {
-			if i >= 5 || col.TotalSize == 0 {
-				break
-			}
-			pct := float64(col.TotalSize) / float64(totalSize) * 100
-			fmt.Printf("  %d. %s.%s.%s: %s (%.1f%%)\n",
-				i+1, col.Schema, col.Table, col.Column,
-				formatBytesHuman(col.TotalSize), pct)
-		}
-	}
-
-	// Recommendations
-	if totalSize > 100*1024*1024 { // > 100MB
-		fmt.Println("\n───────────────────────────────────────────────────────────────────")
-		fmt.Println("RECOMMENDATIONS:")
-		fmt.Printf("  • You have %s of blob data which could benefit from extraction\n", formatBytesHuman(totalSize))
-		fmt.Println("  • Consider using 'dbbackup blob extract' to externalize large objects")
-		fmt.Println("  • This can improve backup speed and deduplication ratios")
-	}
-
-	return nil
-}
-
-func formatBytesHuman(bytes int64) string {
-	const unit = 1024
-	if bytes < unit {
-		return fmt.Sprintf("%d B", bytes)
-	}
-	div, exp := int64(unit), 0
-	for n := bytes / unit; n >= unit; n /= unit {
-		div *= unit
-		exp++
-	}
-	return fmt.Sprintf("%.1f %cB", float64(bytes)/float64(div), "KMGTPE"[exp])
-}
-
-func formatNumberWithCommas(n int64) string {
-	str := fmt.Sprintf("%d", n)
-	if len(str) <= 3 {
-		return str
-	}
-
-	var result strings.Builder
-	for i, c := range str {
-		if i > 0 && (len(str)-i)%3 == 0 {
-			result.WriteRune(',')
-		}
-		result.WriteRune(c)
-	}
-	return result.String()
-}
-
-func truncateBlobStr(s string, max int) string {
-	if len(s) <= max {
-		return s
-	}
-	return s[:max-1] + "…"
-}

cmd/catalog.go

@@ -271,20 +271,12 @@ func runCatalogSync(cmd *cobra.Command, args []string) error {
 	fmt.Printf("  [OK] Added:   %d\n", result.Added)
 	fmt.Printf("  [SYNC] Updated: %d\n", result.Updated)
 	fmt.Printf("  [DEL]  Removed: %d\n", result.Removed)
-	if result.Skipped > 0 {
-		fmt.Printf("  [SKIP] Skipped: %d (legacy files without metadata)\n", result.Skipped)
-	}
 	if result.Errors > 0 {
 		fmt.Printf("  [FAIL] Errors:  %d\n", result.Errors)
 	}
 	fmt.Printf("  [TIME]  Duration: %.2fs\n", result.Duration)
 	fmt.Printf("=====================================================\n")
 
-	// Show legacy backup warning
-	if result.LegacyWarning != "" {
-		fmt.Printf("\n[WARN] %s\n", result.LegacyWarning)
-	}
-
 	// Show details if verbose
 	if catalogVerbose && len(result.Details) > 0 {
 		fmt.Printf("\nDetails:\n")

cmd/cloud.go

@@ -30,12 +30,7 @@ Configuration via flags or environment variables:
   --cloud-region        DBBACKUP_CLOUD_REGION
   --cloud-endpoint      DBBACKUP_CLOUD_ENDPOINT
   --cloud-access-key    DBBACKUP_CLOUD_ACCESS_KEY (or AWS_ACCESS_KEY_ID)
-  --cloud-secret-key    DBBACKUP_CLOUD_SECRET_KEY (or AWS_SECRET_ACCESS_KEY)
-  --bandwidth-limit     DBBACKUP_BANDWIDTH_LIMIT
-
-Bandwidth Limiting:
-  Limit upload/download speed to avoid saturating network during business hours.
-  Examples: 10MB/s, 50MiB/s, 100Mbps, unlimited`,
+  --cloud-secret-key    DBBACKUP_CLOUD_SECRET_KEY (or AWS_SECRET_ACCESS_KEY)`,
 }
 
 var cloudUploadCmd = &cobra.Command{
@@ -108,16 +103,15 @@ Examples:
 }
 
 var (
-	cloudProvider       string
-	cloudBucket         string
-	cloudRegion         string
-	cloudEndpoint       string
-	cloudAccessKey      string
-	cloudSecretKey      string
-	cloudPrefix         string
-	cloudVerbose        bool
-	cloudConfirm        bool
-	cloudBandwidthLimit string
+	cloudProvider  string
+	cloudBucket    string
+	cloudRegion    string
+	cloudEndpoint  string
+	cloudAccessKey string
+	cloudSecretKey string
+	cloudPrefix    string
+	cloudVerbose   bool
+	cloudConfirm   bool
 )
 
 func init() {
@@ -133,7 +127,6 @@ func init() {
 		cmd.Flags().StringVar(&cloudAccessKey, "cloud-access-key", getEnv("DBBACKUP_CLOUD_ACCESS_KEY", getEnv("AWS_ACCESS_KEY_ID", "")), "Access key")
 		cmd.Flags().StringVar(&cloudSecretKey, "cloud-secret-key", getEnv("DBBACKUP_CLOUD_SECRET_KEY", getEnv("AWS_SECRET_ACCESS_KEY", "")), "Secret key")
 		cmd.Flags().StringVar(&cloudPrefix, "cloud-prefix", getEnv("DBBACKUP_CLOUD_PREFIX", ""), "Key prefix")
-		cmd.Flags().StringVar(&cloudBandwidthLimit, "bandwidth-limit", getEnv("DBBACKUP_BANDWIDTH_LIMIT", ""), "Bandwidth limit (e.g., 10MB/s, 100Mbps, 50MiB/s)")
 		cmd.Flags().BoolVarP(&cloudVerbose, "verbose", "v", false, "Verbose output")
 	}
 
@@ -148,40 +141,24 @@ func getEnv(key, defaultValue string) string {
 }
 
 func getCloudBackend() (cloud.Backend, error) {
-	// Parse bandwidth limit
-	var bandwidthLimit int64
-	if cloudBandwidthLimit != "" {
-		var err error
-		bandwidthLimit, err = cloud.ParseBandwidth(cloudBandwidthLimit)
-		if err != nil {
-			return nil, fmt.Errorf("invalid bandwidth limit: %w", err)
-		}
-	}
-
 	cfg := &cloud.Config{
-		Provider:       cloudProvider,
-		Bucket:         cloudBucket,
-		Region:         cloudRegion,
-		Endpoint:       cloudEndpoint,
-		AccessKey:      cloudAccessKey,
-		SecretKey:      cloudSecretKey,
-		Prefix:         cloudPrefix,
-		UseSSL:         true,
-		PathStyle:      cloudProvider == "minio",
-		Timeout:        300,
-		MaxRetries:     3,
-		BandwidthLimit: bandwidthLimit,
+		Provider:   cloudProvider,
+		Bucket:     cloudBucket,
+		Region:     cloudRegion,
+		Endpoint:   cloudEndpoint,
+		AccessKey:  cloudAccessKey,
+		SecretKey:  cloudSecretKey,
+		Prefix:     cloudPrefix,
+		UseSSL:     true,
+		PathStyle:  cloudProvider == "minio",
+		Timeout:    300,
+		MaxRetries: 3,
 	}
 
 	if cfg.Bucket == "" {
 		return nil, fmt.Errorf("bucket name is required (use --cloud-bucket or DBBACKUP_CLOUD_BUCKET)")
 	}
 
-	// Log bandwidth limit if set
-	if bandwidthLimit > 0 {
-		fmt.Printf("📊 Bandwidth limit: %s\n", cloud.FormatBandwidth(bandwidthLimit))
-	}
-
 	backend, err := cloud.NewBackend(cfg)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create cloud backend: %w", err)

cmd/cost.go

@@ -1,396 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	"dbbackup/internal/catalog"
-
-	"github.com/spf13/cobra"
-)
-
-var (
-	costDatabase string
-	costFormat   string
-	costRegion   string
-	costProvider string
-	costDays     int
-)
-
-// costCmd analyzes backup storage costs
-var costCmd = &cobra.Command{
-	Use:   "cost",
-	Short: "Analyze cloud storage costs for backups",
-	Long: `Calculate and compare cloud storage costs for your backups.
-
-Analyzes storage costs across providers:
-  - AWS S3 (Standard, IA, Glacier, Deep Archive)
-  - Google Cloud Storage (Standard, Nearline, Coldline, Archive)
-  - Azure Blob Storage (Hot, Cool, Archive)
-  - Backblaze B2
-  - Wasabi
-
-Pricing is based on standard rates and may vary by region.
-
-Examples:
-  # Analyze all backups
-  dbbackup cost analyze
-
-  # Specific database
-  dbbackup cost analyze --database mydb
-
-  # Compare providers for 90 days
-  dbbackup cost analyze --days 90 --format table
-
-  # Estimate for specific region
-  dbbackup cost analyze --region us-east-1
-
-  # JSON output for automation
-  dbbackup cost analyze --format json`,
-}
-
-var costAnalyzeCmd = &cobra.Command{
-	Use:   "analyze",
-	Short: "Analyze backup storage costs",
-	Args:  cobra.NoArgs,
-	RunE:  runCostAnalyze,
-}
-
-func init() {
-	rootCmd.AddCommand(costCmd)
-	costCmd.AddCommand(costAnalyzeCmd)
-
-	costAnalyzeCmd.Flags().StringVar(&costDatabase, "database", "", "Filter by database")
-	costAnalyzeCmd.Flags().StringVar(&costFormat, "format", "table", "Output format (table, json)")
-	costAnalyzeCmd.Flags().StringVar(&costRegion, "region", "us-east-1", "Cloud region for pricing")
-	costAnalyzeCmd.Flags().StringVar(&costProvider, "provider", "all", "Show specific provider (all, aws, gcs, azure, b2, wasabi)")
-	costAnalyzeCmd.Flags().IntVar(&costDays, "days", 30, "Number of days to calculate")
-}
-
-func runCostAnalyze(cmd *cobra.Command, args []string) error {
-	cat, err := openCatalog()
-	if err != nil {
-		return err
-	}
-	defer cat.Close()
-
-	ctx := context.Background()
-
-	// Get backup statistics
-	var stats *catalog.Stats
-	if costDatabase != "" {
-		stats, err = cat.StatsByDatabase(ctx, costDatabase)
-	} else {
-		stats, err = cat.Stats(ctx)
-	}
-	if err != nil {
-		return err
-	}
-
-	if stats.TotalBackups == 0 {
-		fmt.Println("No backups found in catalog. Run 'dbbackup catalog sync' first.")
-		return nil
-	}
-
-	// Calculate costs
-	analysis := calculateCosts(stats.TotalSize, costDays, costRegion)
-
-	if costFormat == "json" {
-		return outputCostJSON(analysis, stats)
-	}
-
-	return outputCostTable(analysis, stats)
-}
-
-// StorageTier represents a storage class/tier
-type StorageTier struct {
-	Provider    string
-	Tier        string
-	Description string
-	StorageGB   float64 // $ per GB/month
-	RetrievalGB float64 // $ per GB retrieved
-	Requests    float64 // $ per 1000 requests
-	MinDays     int     // Minimum storage duration
-}
-
-// CostAnalysis represents the cost breakdown
-type CostAnalysis struct {
-	TotalSizeGB    float64
-	Days           int
-	Region         string
-	Recommendations []TierRecommendation
-}
-
-type TierRecommendation struct {
-	Provider       string
-	Tier           string
-	Description    string
-	MonthlyStorage float64
-	AnnualStorage  float64
-	RetrievalCost  float64
-	TotalMonthly   float64
-	TotalAnnual    float64
-	SavingsVsS3    float64
-	SavingsPct     float64
-	BestFor        string
-}
-
-func calculateCosts(totalBytes int64, days int, region string) *CostAnalysis {
-	sizeGB := float64(totalBytes) / (1024 * 1024 * 1024)
-	
-	analysis := &CostAnalysis{
-		TotalSizeGB: sizeGB,
-		Days:        days,
-		Region:      region,
-	}
-
-	// Define storage tiers (pricing as of 2026, approximate)
-	tiers := []StorageTier{
-		// AWS S3
-		{Provider: "AWS S3", Tier: "Standard", Description: "Frequent access", 
-			StorageGB: 0.023, RetrievalGB: 0.0, Requests: 0.0004, MinDays: 0},
-		{Provider: "AWS S3", Tier: "Intelligent-Tiering", Description: "Auto-optimization",
-			StorageGB: 0.023, RetrievalGB: 0.0, Requests: 0.0004, MinDays: 0},
-		{Provider: "AWS S3", Tier: "Standard-IA", Description: "Infrequent access",
-			StorageGB: 0.0125, RetrievalGB: 0.01, Requests: 0.001, MinDays: 30},
-		{Provider: "AWS S3", Tier: "Glacier Instant", Description: "Archive instant",
-			StorageGB: 0.004, RetrievalGB: 0.03, Requests: 0.01, MinDays: 90},
-		{Provider: "AWS S3", Tier: "Glacier Flexible", Description: "Archive flexible",
-			StorageGB: 0.0036, RetrievalGB: 0.02, Requests: 0.05, MinDays: 90},
-		{Provider: "AWS S3", Tier: "Deep Archive", Description: "Long-term archive",
-			StorageGB: 0.00099, RetrievalGB: 0.02, Requests: 0.05, MinDays: 180},
-		
-		// Google Cloud Storage
-		{Provider: "GCS", Tier: "Standard", Description: "Frequent access",
-			StorageGB: 0.020, RetrievalGB: 0.0, Requests: 0.0004, MinDays: 0},
-		{Provider: "GCS", Tier: "Nearline", Description: "Monthly access",
-			StorageGB: 0.010, RetrievalGB: 0.01, Requests: 0.001, MinDays: 30},
-		{Provider: "GCS", Tier: "Coldline", Description: "Quarterly access",
-			StorageGB: 0.004, RetrievalGB: 0.02, Requests: 0.005, MinDays: 90},
-		{Provider: "GCS", Tier: "Archive", Description: "Annual access",
-			StorageGB: 0.0012, RetrievalGB: 0.05, Requests: 0.05, MinDays: 365},
-		
-		// Azure Blob Storage
-		{Provider: "Azure", Tier: "Hot", Description: "Frequent access",
-			StorageGB: 0.0184, RetrievalGB: 0.0, Requests: 0.0004, MinDays: 0},
-		{Provider: "Azure", Tier: "Cool", Description: "Infrequent access",
-			StorageGB: 0.010, RetrievalGB: 0.01, Requests: 0.001, MinDays: 30},
-		{Provider: "Azure", Tier: "Archive", Description: "Long-term archive",
-			StorageGB: 0.00099, RetrievalGB: 0.02, Requests: 0.05, MinDays: 180},
-		
-		// Backblaze B2
-		{Provider: "Backblaze B2", Tier: "Standard", Description: "Affordable cloud",
-			StorageGB: 0.005, RetrievalGB: 0.01, Requests: 0.0004, MinDays: 0},
-		
-		// Wasabi
-		{Provider: "Wasabi", Tier: "Hot Cloud", Description: "No egress fees",
-			StorageGB: 0.0059, RetrievalGB: 0.0, Requests: 0.0, MinDays: 90},
-	}
-
-	// Calculate costs for each tier
-	s3StandardCost := 0.0
-	for _, tier := range tiers {
-		if costProvider != "all" {
-			providerLower := strings.ToLower(tier.Provider)
-			filterLower := strings.ToLower(costProvider)
-			if !strings.Contains(providerLower, filterLower) {
-				continue
-			}
-		}
-
-		rec := TierRecommendation{
-			Provider:    tier.Provider,
-			Tier:        tier.Tier,
-			Description: tier.Description,
-		}
-
-		// Monthly storage cost
-		rec.MonthlyStorage = sizeGB * tier.StorageGB
-
-		// Annual storage cost
-		rec.AnnualStorage = rec.MonthlyStorage * 12
-
-		// Estimate retrieval cost (assume 1 retrieval per month for DR testing)
-		rec.RetrievalCost = sizeGB * tier.RetrievalGB
-
-		// Total costs
-		rec.TotalMonthly = rec.MonthlyStorage + rec.RetrievalCost
-		rec.TotalAnnual = rec.AnnualStorage + (rec.RetrievalCost * 12)
-
-		// Track S3 Standard for comparison
-		if tier.Provider == "AWS S3" && tier.Tier == "Standard" {
-			s3StandardCost = rec.TotalMonthly
-		}
-
-		// Recommendations
-		switch {
-		case tier.MinDays >= 180:
-			rec.BestFor = "Long-term archives (6+ months)"
-		case tier.MinDays >= 90:
-			rec.BestFor = "Compliance archives (3+ months)"
-		case tier.MinDays >= 30:
-			rec.BestFor = "Recent backups (monthly rotation)"
-		default:
-			rec.BestFor = "Active/hot backups (daily access)"
-		}
-
-		analysis.Recommendations = append(analysis.Recommendations, rec)
-	}
-
-	// Calculate savings vs S3 Standard
-	if s3StandardCost > 0 {
-		for i := range analysis.Recommendations {
-			rec := &analysis.Recommendations[i]
-			rec.SavingsVsS3 = s3StandardCost - rec.TotalMonthly
-			if s3StandardCost > 0 {
-				rec.SavingsPct = (rec.SavingsVsS3 / s3StandardCost) * 100.0
-			}
-		}
-	}
-
-	return analysis
-}
-
-func outputCostTable(analysis *CostAnalysis, stats *catalog.Stats) error {
-	fmt.Println()
-	fmt.Println("═══════════════════════════════════════════════════════════════════════════")
-	fmt.Printf("  Cloud Storage Cost Analysis\n")
-	fmt.Println("═══════════════════════════════════════════════════════════════════════════")
-	fmt.Println()
-
-	fmt.Printf("[CURRENT BACKUP INVENTORY]\n")
-	fmt.Printf("  Total Backups:     %d\n", stats.TotalBackups)
-	fmt.Printf("  Total Size:        %.2f GB (%s)\n", analysis.TotalSizeGB, stats.TotalSizeHuman)
-	if costDatabase != "" {
-		fmt.Printf("  Database:          %s\n", costDatabase)
-	} else {
-		fmt.Printf("  Databases:         %d\n", len(stats.ByDatabase))
-	}
-	fmt.Printf("  Region:            %s\n", analysis.Region)
-	fmt.Printf("  Analysis Period:   %d days\n", analysis.Days)
-	fmt.Println()
-
-	fmt.Println("───────────────────────────────────────────────────────────────────────────")
-	fmt.Printf("%-20s %-20s %12s %12s %12s\n", 
-		"PROVIDER", "TIER", "MONTHLY", "ANNUAL", "SAVINGS")
-	fmt.Println("───────────────────────────────────────────────────────────────────────────")
-
-	for _, rec := range analysis.Recommendations {
-		savings := ""
-		if rec.SavingsVsS3 > 0 {
-			savings = fmt.Sprintf("↓ $%.2f (%.0f%%)", rec.SavingsVsS3, rec.SavingsPct)
-		} else if rec.SavingsVsS3 < 0 {
-			savings = fmt.Sprintf("↑ $%.2f", -rec.SavingsVsS3)
-		} else {
-			savings = "baseline"
-		}
-
-		fmt.Printf("%-20s %-20s $%10.2f $%10.2f  %s\n",
-			rec.Provider,
-			rec.Tier,
-			rec.TotalMonthly,
-			rec.TotalAnnual,
-			savings,
-		)
-	}
-
-	fmt.Println("───────────────────────────────────────────────────────────────────────────")
-	fmt.Println()
-
-	// Top recommendations
-	fmt.Println("[COST OPTIMIZATION RECOMMENDATIONS]")
-	fmt.Println()
-
-	// Find cheapest option
-	cheapest := analysis.Recommendations[0]
-	for _, rec := range analysis.Recommendations {
-		if rec.TotalAnnual < cheapest.TotalAnnual {
-			cheapest = rec
-		}
-	}
-
-	fmt.Printf("💰 CHEAPEST OPTION: %s %s\n", cheapest.Provider, cheapest.Tier)
-	fmt.Printf("   Annual Cost: $%.2f (save $%.2f/year vs S3 Standard)\n", 
-		cheapest.TotalAnnual, cheapest.SavingsVsS3*12)
-	fmt.Printf("   Best For: %s\n", cheapest.BestFor)
-	fmt.Println()
-
-	// Find best balance
-	fmt.Printf("⚖️  BALANCED OPTION: AWS S3 Standard-IA or GCS Nearline\n")
-	fmt.Printf("   Good balance of cost and accessibility\n")
-	fmt.Printf("   Suitable for 30-day retention backups\n")
-	fmt.Println()
-
-	// Find hot storage
-	fmt.Printf("🔥 HOT STORAGE: Wasabi or Backblaze B2\n")
-	fmt.Printf("   No egress fees (Wasabi) or low retrieval costs\n")
-	fmt.Printf("   Perfect for frequent restore testing\n")
-	fmt.Println()
-
-	// Strategy recommendation
-	fmt.Println("[TIERED STORAGE STRATEGY]")
-	fmt.Println()
-	fmt.Printf("   Day 0-7:     S3 Standard or Wasabi        (frequent access)\n")
-	fmt.Printf("   Day 8-30:    S3 Standard-IA or GCS Nearline  (weekly access)\n")
-	fmt.Printf("   Day 31-90:   S3 Glacier or GCS Coldline      (monthly access)\n")
-	fmt.Printf("   Day 90+:     S3 Deep Archive or GCS Archive  (compliance)\n")
-	fmt.Println()
-
-	potentialSaving := 0.0
-	for _, rec := range analysis.Recommendations {
-		if rec.Provider == "AWS S3" && rec.Tier == "Deep Archive" {
-			potentialSaving = rec.SavingsVsS3 * 12
-		}
-	}
-
-	if potentialSaving > 0 {
-		fmt.Printf("💡 With tiered lifecycle policies, you could save ~$%.2f/year\n", potentialSaving)
-	}
-
-	fmt.Println()
-	fmt.Println("═══════════════════════════════════════════════════════════════════════════")
-	fmt.Println()
-	fmt.Println("Note: Costs are estimates based on standard pricing.")
-	fmt.Println("Actual costs may vary by region, usage patterns, and current pricing.")
-	fmt.Println()
-
-	return nil
-}
-
-func outputCostJSON(analysis *CostAnalysis, stats *catalog.Stats) error {
-	output := map[string]interface{}{
-		"inventory": map[string]interface{}{
-			"total_backups":     stats.TotalBackups,
-			"total_size_gb":     analysis.TotalSizeGB,
-			"total_size_human":  stats.TotalSizeHuman,
-			"region":            analysis.Region,
-			"analysis_days":     analysis.Days,
-		},
-		"recommendations": analysis.Recommendations,
-	}
-
-	// Find cheapest
-	cheapest := analysis.Recommendations[0]
-	for _, rec := range analysis.Recommendations {
-		if rec.TotalAnnual < cheapest.TotalAnnual {
-			cheapest = rec
-		}
-	}
-
-	output["cheapest"] = map[string]interface{}{
-		"provider":     cheapest.Provider,
-		"tier":         cheapest.Tier,
-		"annual_cost":  cheapest.TotalAnnual,
-		"monthly_cost": cheapest.TotalMonthly,
-	}
-
-	data, err := json.MarshalIndent(output, "", "  ")
-	if err != nil {
-		return err
-	}
-
-	fmt.Println(string(data))
-	return nil
-}

cmd/dedup.go

@@ -6,14 +6,12 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
 	"time"
 
 	"dbbackup/internal/dedup"
 
-	"github.com/klauspost/pgzip"
 	"github.com/spf13/cobra"
 )
 
@@ -36,24 +34,7 @@ Storage Structure:
     chunks/       # Content-addressed chunk files
       ab/cdef...  # Sharded by first 2 chars of hash
     manifests/    # JSON manifest per backup
-    chunks.db     # SQLite index
-
-NFS/CIFS NOTICE:
-  SQLite may have locking issues on network storage.
-  Use --index-db to put the SQLite index on local storage while keeping
-  chunks on network storage:
-  
-    dbbackup dedup backup mydb.sql \
-      --dedup-dir /mnt/nfs/backups/dedup \
-      --index-db /var/lib/dbbackup/dedup-index.db
-
-  This avoids "database is locked" errors while still storing chunks remotely.
-
-COMPRESSED INPUT NOTICE:
-  Pre-compressed files (.gz) have poor deduplication ratios (<10%).
-  Use --decompress-input to decompress before chunking for better results:
-  
-    dbbackup dedup backup mydb.sql.gz --decompress-input`,
+    chunks.db     # SQLite index`,
 }
 
 var dedupBackupCmd = &cobra.Command{
@@ -108,93 +89,16 @@ var dedupDeleteCmd = &cobra.Command{
 	RunE:  runDedupDelete,
 }
 
-var dedupVerifyCmd = &cobra.Command{
-	Use:   "verify [manifest-id]",
-	Short: "Verify chunk integrity against manifests",
-	Long: `Verify that all chunks referenced by manifests exist and have correct hashes.
-
-Without arguments, verifies all backups. With a manifest ID, verifies only that backup.
-
-Examples:
-  dbbackup dedup verify                    # Verify all backups
-  dbbackup dedup verify 2026-01-07_mydb    # Verify specific backup`,
-	RunE: runDedupVerify,
-}
-
-var dedupPruneCmd = &cobra.Command{
-	Use:   "prune",
-	Short: "Apply retention policy to manifests",
-	Long: `Delete old manifests based on retention policy (like borg prune).
-
-Keeps a specified number of recent backups per database and deletes the rest.
-
-Examples:
-  dbbackup dedup prune --keep-last 7                    # Keep 7 most recent
-  dbbackup dedup prune --keep-daily 7 --keep-weekly 4   # Keep 7 daily + 4 weekly`,
-	RunE: runDedupPrune,
-}
-
-var dedupBackupDBCmd = &cobra.Command{
-	Use:   "backup-db",
-	Short: "Direct database dump with deduplication",
-	Long: `Dump a database directly into deduplicated chunks without temp files.
-
-Streams the database dump through the chunker for efficient deduplication.
-
-Examples:
-  dbbackup dedup backup-db --db-type postgres --db-name mydb
-  dbbackup dedup backup-db -d mariadb --database production_db --host db.local`,
-	RunE: runDedupBackupDB,
-}
-
-// Prune flags
-var (
-	pruneKeepLast   int
-	pruneKeepDaily  int
-	pruneKeepWeekly int
-	pruneDryRun     bool
-)
-
-// backup-db flags
-var (
-	backupDBDatabase string
-	backupDBUser     string
-	backupDBPassword string
-)
-
-// metrics flags
-var (
-	dedupMetricsOutput string
-	dedupMetricsServer string
-)
-
-var dedupMetricsCmd = &cobra.Command{
-	Use:   "metrics",
-	Short: "Export dedup statistics as Prometheus metrics",
-	Long: `Export deduplication statistics in Prometheus format.
-
-Can write to a textfile for node_exporter's textfile collector,
-or print to stdout for custom integrations.
-
-Examples:
-  dbbackup dedup metrics                                    # Print to stdout
-  dbbackup dedup metrics --output /var/lib/node_exporter/textfile_collector/dedup.prom
-  dbbackup dedup metrics --instance prod-db-1`,
-	RunE: runDedupMetrics,
-}
-
 // Flags
 var (
-	dedupDir        string
-	dedupIndexDB    string // Separate path for SQLite index (for NFS/CIFS support)
-	dedupCompress   bool
-	dedupEncrypt    bool
-	dedupKey        string
-	dedupName       string
-	dedupDBType     string
-	dedupDBName     string
-	dedupDBHost     string
-	dedupDecompress bool // Auto-decompress gzip input
+	dedupDir       string
+	dedupCompress  bool
+	dedupEncrypt   bool
+	dedupKey       string
+	dedupName      string
+	dedupDBType    string
+	dedupDBName    string
+	dedupDBHost    string
 )
 
 func init() {
@@ -205,14 +109,9 @@ func init() {
 	dedupCmd.AddCommand(dedupStatsCmd)
 	dedupCmd.AddCommand(dedupGCCmd)
 	dedupCmd.AddCommand(dedupDeleteCmd)
-	dedupCmd.AddCommand(dedupVerifyCmd)
-	dedupCmd.AddCommand(dedupPruneCmd)
-	dedupCmd.AddCommand(dedupBackupDBCmd)
-	dedupCmd.AddCommand(dedupMetricsCmd)
 
 	// Global dedup flags
 	dedupCmd.PersistentFlags().StringVar(&dedupDir, "dedup-dir", "", "Dedup storage directory (default: $BACKUP_DIR/dedup)")
-	dedupCmd.PersistentFlags().StringVar(&dedupIndexDB, "index-db", "", "SQLite index path (local recommended for NFS/CIFS chunk dirs)")
 	dedupCmd.PersistentFlags().BoolVar(&dedupCompress, "compress", true, "Compress chunks with gzip")
 	dedupCmd.PersistentFlags().BoolVar(&dedupEncrypt, "encrypt", false, "Encrypt chunks with AES-256-GCM")
 	dedupCmd.PersistentFlags().StringVar(&dedupKey, "key", "", "Encryption key (hex) or use DBBACKUP_DEDUP_KEY env")
@@ -222,26 +121,6 @@ func init() {
 	dedupBackupCmd.Flags().StringVar(&dedupDBType, "db-type", "", "Database type (postgres/mysql)")
 	dedupBackupCmd.Flags().StringVar(&dedupDBName, "db-name", "", "Database name")
 	dedupBackupCmd.Flags().StringVar(&dedupDBHost, "db-host", "", "Database host")
-	dedupBackupCmd.Flags().BoolVar(&dedupDecompress, "decompress-input", false, "Auto-decompress gzip input before chunking (improves dedup ratio)")
-
-	// Prune flags
-	dedupPruneCmd.Flags().IntVar(&pruneKeepLast, "keep-last", 0, "Keep the last N backups")
-	dedupPruneCmd.Flags().IntVar(&pruneKeepDaily, "keep-daily", 0, "Keep N daily backups")
-	dedupPruneCmd.Flags().IntVar(&pruneKeepWeekly, "keep-weekly", 0, "Keep N weekly backups")
-	dedupPruneCmd.Flags().BoolVar(&pruneDryRun, "dry-run", false, "Show what would be deleted without actually deleting")
-
-	// backup-db flags
-	dedupBackupDBCmd.Flags().StringVarP(&dedupDBType, "db-type", "d", "", "Database type (postgres/mariadb/mysql)")
-	dedupBackupDBCmd.Flags().StringVar(&backupDBDatabase, "database", "", "Database name to backup")
-	dedupBackupDBCmd.Flags().StringVar(&dedupDBHost, "host", "localhost", "Database host")
-	dedupBackupDBCmd.Flags().StringVarP(&backupDBUser, "user", "u", "", "Database user")
-	dedupBackupDBCmd.Flags().StringVarP(&backupDBPassword, "password", "p", "", "Database password (or use env)")
-	dedupBackupDBCmd.MarkFlagRequired("db-type")
-	dedupBackupDBCmd.MarkFlagRequired("database")
-
-	// Metrics flags
-	dedupMetricsCmd.Flags().StringVarP(&dedupMetricsOutput, "output", "o", "", "Output file path (default: stdout)")
-	dedupMetricsCmd.Flags().StringVar(&dedupMetricsServer, "server", "", "Server label for metrics (default: hostname)")
 }
 
 func getDedupDir() string {
@@ -254,14 +133,6 @@ func getDedupDir() string {
 	return filepath.Join(os.Getenv("HOME"), "db_backups", "dedup")
 }
 
-func getIndexDBPath() string {
-	if dedupIndexDB != "" {
-		return dedupIndexDB
-	}
-	// Default: same directory as chunks (may have issues on NFS/CIFS)
-	return filepath.Join(getDedupDir(), "chunks.db")
-}
-
 func getEncryptionKey() string {
 	if dedupKey != "" {
 		return dedupKey
@@ -284,25 +155,6 @@ func runDedupBackup(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("failed to stat input file: %w", err)
 	}
 
-	// Check for compressed input and warn/handle
-	var reader io.Reader = file
-	isGzipped := strings.HasSuffix(strings.ToLower(inputPath), ".gz")
-	if isGzipped && !dedupDecompress {
-		fmt.Printf("Warning: Input appears to be gzip compressed (.gz)\n")
-		fmt.Printf("  Compressed data typically has poor dedup ratios (<10%%).\n")
-		fmt.Printf("  Consider using --decompress-input for better deduplication.\n\n")
-	}
-
-	if isGzipped && dedupDecompress {
-		fmt.Printf("Auto-decompressing gzip input for better dedup ratio...\n")
-		gzReader, err := pgzip.NewReader(file)
-		if err != nil {
-			return fmt.Errorf("failed to decompress gzip input: %w", err)
-		}
-		defer gzReader.Close()
-		reader = gzReader
-	}
-
 	// Setup dedup storage
 	basePath := getDedupDir()
 	encKey := ""
@@ -327,7 +179,7 @@ func runDedupBackup(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("failed to open manifest store: %w", err)
 	}
 
-	index, err := dedup.NewChunkIndexAt(getIndexDBPath())
+	index, err := dedup.NewChunkIndex(basePath)
 	if err != nil {
 		return fmt.Errorf("failed to open chunk index: %w", err)
 	}
@@ -341,43 +193,22 @@ func runDedupBackup(cmd *cobra.Command, args []string) error {
 	} else {
 		base := filepath.Base(inputPath)
 		ext := filepath.Ext(base)
-		// Remove .gz extension if decompressing
-		if isGzipped && dedupDecompress {
-			base = strings.TrimSuffix(base, ext)
-			ext = filepath.Ext(base)
-		}
 		manifestID += "_" + strings.TrimSuffix(base, ext)
 	}
 
 	fmt.Printf("Creating deduplicated backup: %s\n", manifestID)
 	fmt.Printf("Input: %s (%s)\n", inputPath, formatBytes(info.Size()))
-	if isGzipped && dedupDecompress {
-		fmt.Printf("Mode: Decompressing before chunking\n")
-	}
 	fmt.Printf("Store: %s\n", basePath)
-	if dedupIndexDB != "" {
-		fmt.Printf("Index: %s\n", getIndexDBPath())
-	}
 
-	// For decompressed input, we can't seek - use TeeReader to hash while chunking
+	// Hash the entire file for verification
+	file.Seek(0, 0)
 	h := sha256.New()
-	var chunkReader io.Reader
-
-	if isGzipped && dedupDecompress {
-		// Can't seek on gzip stream - hash will be computed inline
-		chunkReader = io.TeeReader(reader, h)
-	} else {
-		// Regular file - hash first, then reset and chunk
-		file.Seek(0, 0)
-		io.Copy(h, file)
-		file.Seek(0, 0)
-		chunkReader = file
-		h = sha256.New() // Reset for inline hashing
-		chunkReader = io.TeeReader(file, h)
-	}
+	io.Copy(h, file)
+	fileHash := hex.EncodeToString(h.Sum(nil))
+	file.Seek(0, 0)
 
 	// Chunk the file
-	chunker := dedup.NewChunker(chunkReader, dedup.DefaultChunkerConfig())
+	chunker := dedup.NewChunker(file, dedup.DefaultChunkerConfig())
 	var chunks []dedup.ChunkRef
 	var totalSize, storedSize int64
 	var chunkCount, newChunks int
@@ -423,9 +254,6 @@ func runDedupBackup(cmd *cobra.Command, args []string) error {
 
 	duration := time.Since(startTime)
 
-	// Get final hash (computed inline via TeeReader)
-	fileHash := hex.EncodeToString(h.Sum(nil))
-
 	// Calculate dedup ratio
 	dedupRatio := 0.0
 	if totalSize > 0 {
@@ -449,7 +277,6 @@ func runDedupBackup(cmd *cobra.Command, args []string) error {
 		Encrypted:    dedupEncrypt,
 		Compressed:   dedupCompress,
 		SHA256:       fileHash,
-		Decompressed: isGzipped && dedupDecompress, // Track if we decompressed
 	}
 
 	if err := manifestStore.Save(manifest); err != nil {
@@ -596,7 +423,7 @@ func runDedupList(cmd *cobra.Command, args []string) error {
 func runDedupStats(cmd *cobra.Command, args []string) error {
 	basePath := getDedupDir()
 
-	index, err := dedup.NewChunkIndexAt(getIndexDBPath())
+	index, err := dedup.NewChunkIndex(basePath)
 	if err != nil {
 		return fmt.Errorf("failed to open chunk index: %w", err)
 	}
@@ -624,12 +451,8 @@ func runDedupStats(cmd *cobra.Command, args []string) error {
 	fmt.Printf("Unique chunks:   %d\n", stats.TotalChunks)
 	fmt.Printf("Total raw size:  %s\n", formatBytes(stats.TotalSizeRaw))
 	fmt.Printf("Stored size:     %s\n", formatBytes(stats.TotalSizeStored))
-	fmt.Printf("\n")
-	fmt.Printf("Backup Statistics (accurate dedup calculation):\n")
-	fmt.Printf("  Total backed up:  %s (across all backups)\n", formatBytes(stats.TotalBackupSize))
-	fmt.Printf("  New data stored:  %s\n", formatBytes(stats.TotalNewData))
-	fmt.Printf("  Space saved:      %s\n", formatBytes(stats.SpaceSaved))
-	fmt.Printf("  Dedup ratio:      %.1f%%\n", stats.DedupRatio*100)
+	fmt.Printf("Dedup ratio:     %.1f%%\n", stats.DedupRatio*100)
+	fmt.Printf("Space saved:     %s\n", formatBytes(stats.TotalSizeRaw-stats.TotalSizeStored))
 
 	if storeStats != nil {
 		fmt.Printf("Disk usage:      %s\n", formatBytes(storeStats.TotalSize))
@@ -642,7 +465,7 @@ func runDedupStats(cmd *cobra.Command, args []string) error {
 func runDedupGC(cmd *cobra.Command, args []string) error {
 	basePath := getDedupDir()
 
-	index, err := dedup.NewChunkIndexAt(getIndexDBPath())
+	index, err := dedup.NewChunkIndex(basePath)
 	if err != nil {
 		return fmt.Errorf("failed to open chunk index: %w", err)
 	}
@@ -702,7 +525,7 @@ func runDedupDelete(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("failed to open manifest store: %w", err)
 	}
 
-	index, err := dedup.NewChunkIndexAt(getIndexDBPath())
+	index, err := dedup.NewChunkIndex(basePath)
 	if err != nil {
 		return fmt.Errorf("failed to open chunk index: %w", err)
 	}
@@ -754,531 +577,3 @@ func truncateStr(s string, max int) string {
 	}
 	return s[:max-3] + "..."
 }
-
-func runDedupVerify(cmd *cobra.Command, args []string) error {
-	basePath := getDedupDir()
-
-	store, err := dedup.NewChunkStore(dedup.StoreConfig{
-		BasePath: basePath,
-		Compress: dedupCompress,
-	})
-	if err != nil {
-		return fmt.Errorf("failed to open chunk store: %w", err)
-	}
-
-	manifestStore, err := dedup.NewManifestStore(basePath)
-	if err != nil {
-		return fmt.Errorf("failed to open manifest store: %w", err)
-	}
-
-	index, err := dedup.NewChunkIndexAt(getIndexDBPath())
-	if err != nil {
-		return fmt.Errorf("failed to open chunk index: %w", err)
-	}
-	defer index.Close()
-
-	var manifests []*dedup.Manifest
-
-	if len(args) > 0 {
-		// Verify specific manifest
-		m, err := manifestStore.Load(args[0])
-		if err != nil {
-			return fmt.Errorf("failed to load manifest: %w", err)
-		}
-		manifests = []*dedup.Manifest{m}
-	} else {
-		// Verify all manifests
-		manifests, err = manifestStore.ListAll()
-		if err != nil {
-			return fmt.Errorf("failed to list manifests: %w", err)
-		}
-	}
-
-	if len(manifests) == 0 {
-		fmt.Println("No manifests to verify.")
-		return nil
-	}
-
-	fmt.Printf("Verifying %d backup(s)...\n\n", len(manifests))
-
-	var totalChunks, missingChunks, corruptChunks int
-	var allOK = true
-
-	for _, m := range manifests {
-		fmt.Printf("Verifying: %s (%d chunks)\n", m.ID, m.ChunkCount)
-
-		var missing, corrupt int
-		seenHashes := make(map[string]bool)
-
-		for i, ref := range m.Chunks {
-			if seenHashes[ref.Hash] {
-				continue // Already verified this chunk
-			}
-			seenHashes[ref.Hash] = true
-			totalChunks++
-
-			// Check if chunk exists
-			if !store.Has(ref.Hash) {
-				missing++
-				missingChunks++
-				if missing <= 5 {
-					fmt.Printf("  [MISSING] chunk %d: %s\n", i, ref.Hash[:16])
-				}
-				continue
-			}
-
-			// Verify chunk hash by reading it
-			chunk, err := store.Get(ref.Hash)
-			if err != nil {
-				corrupt++
-				corruptChunks++
-				if corrupt <= 5 {
-					fmt.Printf("  [CORRUPT] chunk %d: %s - %v\n", i, ref.Hash[:16], err)
-				}
-				continue
-			}
-
-			// Verify size
-			if chunk.Length != ref.Length {
-				corrupt++
-				corruptChunks++
-				if corrupt <= 5 {
-					fmt.Printf("  [SIZE MISMATCH] chunk %d: expected %d, got %d\n", i, ref.Length, chunk.Length)
-				}
-			}
-		}
-
-		if missing > 0 || corrupt > 0 {
-			allOK = false
-			fmt.Printf("  Result: FAILED (%d missing, %d corrupt)\n", missing, corrupt)
-			if missing > 5 || corrupt > 5 {
-				fmt.Printf("  ... and %d more errors\n", (missing+corrupt)-10)
-			}
-		} else {
-			fmt.Printf("  Result: OK (%d unique chunks verified)\n", len(seenHashes))
-			// Update verified timestamp
-			m.VerifiedAt = time.Now()
-			manifestStore.Save(m)
-			index.UpdateManifestVerified(m.ID, m.VerifiedAt)
-		}
-		fmt.Println()
-	}
-
-	fmt.Println("========================================")
-	if allOK {
-		fmt.Printf("All %d backup(s) verified successfully!\n", len(manifests))
-		fmt.Printf("Total unique chunks checked: %d\n", totalChunks)
-	} else {
-		fmt.Printf("Verification FAILED!\n")
-		fmt.Printf("Missing chunks: %d\n", missingChunks)
-		fmt.Printf("Corrupt chunks: %d\n", corruptChunks)
-		return fmt.Errorf("verification failed: %d missing, %d corrupt chunks", missingChunks, corruptChunks)
-	}
-
-	return nil
-}
-
-func runDedupPrune(cmd *cobra.Command, args []string) error {
-	if pruneKeepLast == 0 && pruneKeepDaily == 0 && pruneKeepWeekly == 0 {
-		return fmt.Errorf("at least one of --keep-last, --keep-daily, or --keep-weekly must be specified")
-	}
-
-	basePath := getDedupDir()
-
-	manifestStore, err := dedup.NewManifestStore(basePath)
-	if err != nil {
-		return fmt.Errorf("failed to open manifest store: %w", err)
-	}
-
-	index, err := dedup.NewChunkIndexAt(getIndexDBPath())
-	if err != nil {
-		return fmt.Errorf("failed to open chunk index: %w", err)
-	}
-	defer index.Close()
-
-	manifests, err := manifestStore.ListAll()
-	if err != nil {
-		return fmt.Errorf("failed to list manifests: %w", err)
-	}
-
-	if len(manifests) == 0 {
-		fmt.Println("No backups to prune.")
-		return nil
-	}
-
-	// Group by database name
-	byDatabase := make(map[string][]*dedup.Manifest)
-	for _, m := range manifests {
-		key := m.DatabaseName
-		if key == "" {
-			key = "_default"
-		}
-		byDatabase[key] = append(byDatabase[key], m)
-	}
-
-	var toDelete []*dedup.Manifest
-
-	for dbName, dbManifests := range byDatabase {
-		// Already sorted by time (newest first from ListAll)
-		kept := make(map[string]bool)
-		var keepReasons = make(map[string]string)
-
-		// Keep last N
-		if pruneKeepLast > 0 {
-			for i := 0; i < pruneKeepLast && i < len(dbManifests); i++ {
-				kept[dbManifests[i].ID] = true
-				keepReasons[dbManifests[i].ID] = "keep-last"
-			}
-		}
-
-		// Keep daily (one per day)
-		if pruneKeepDaily > 0 {
-			seenDays := make(map[string]bool)
-			count := 0
-			for _, m := range dbManifests {
-				day := m.CreatedAt.Format("2006-01-02")
-				if !seenDays[day] {
-					seenDays[day] = true
-					if count < pruneKeepDaily {
-						kept[m.ID] = true
-						if keepReasons[m.ID] == "" {
-							keepReasons[m.ID] = "keep-daily"
-						}
-						count++
-					}
-				}
-			}
-		}
-
-		// Keep weekly (one per week)
-		if pruneKeepWeekly > 0 {
-			seenWeeks := make(map[string]bool)
-			count := 0
-			for _, m := range dbManifests {
-				year, week := m.CreatedAt.ISOWeek()
-				weekKey := fmt.Sprintf("%d-W%02d", year, week)
-				if !seenWeeks[weekKey] {
-					seenWeeks[weekKey] = true
-					if count < pruneKeepWeekly {
-						kept[m.ID] = true
-						if keepReasons[m.ID] == "" {
-							keepReasons[m.ID] = "keep-weekly"
-						}
-						count++
-					}
-				}
-			}
-		}
-
-		if dbName != "_default" {
-			fmt.Printf("\nDatabase: %s\n", dbName)
-		} else {
-			fmt.Printf("\nUnnamed backups:\n")
-		}
-
-		for _, m := range dbManifests {
-			if kept[m.ID] {
-				fmt.Printf("  [KEEP]   %s (%s) - %s\n", m.ID, m.CreatedAt.Format("2006-01-02"), keepReasons[m.ID])
-			} else {
-				fmt.Printf("  [DELETE] %s (%s)\n", m.ID, m.CreatedAt.Format("2006-01-02"))
-				toDelete = append(toDelete, m)
-			}
-		}
-	}
-
-	if len(toDelete) == 0 {
-		fmt.Printf("\nNo backups to prune (all match retention policy).\n")
-		return nil
-	}
-
-	fmt.Printf("\n%d backup(s) will be deleted.\n", len(toDelete))
-
-	if pruneDryRun {
-		fmt.Println("\n[DRY RUN] No changes made. Remove --dry-run to actually delete.")
-		return nil
-	}
-
-	// Actually delete
-	for _, m := range toDelete {
-		// Decrement chunk references
-		for _, ref := range m.Chunks {
-			index.DecrementRef(ref.Hash)
-		}
-
-		if err := manifestStore.Delete(m.ID); err != nil {
-			log.Warn("Failed to delete manifest", "id", m.ID, "error", err)
-		}
-		index.RemoveManifest(m.ID)
-	}
-
-	fmt.Printf("\nDeleted %d backup(s).\n", len(toDelete))
-	fmt.Println("Run 'dbbackup dedup gc' to reclaim space from unreferenced chunks.")
-
-	return nil
-}
-
-func runDedupBackupDB(cmd *cobra.Command, args []string) error {
-	dbType := strings.ToLower(dedupDBType)
-	dbName := backupDBDatabase
-
-	// Validate db type
-	var dumpCmd string
-	var dumpArgs []string
-
-	switch dbType {
-	case "postgres", "postgresql", "pg":
-		dbType = "postgres"
-		dumpCmd = "pg_dump"
-		dumpArgs = []string{"-Fc"} // Custom format for better compression
-		if dedupDBHost != "" && dedupDBHost != "localhost" {
-			dumpArgs = append(dumpArgs, "-h", dedupDBHost)
-		}
-		if backupDBUser != "" {
-			dumpArgs = append(dumpArgs, "-U", backupDBUser)
-		}
-		dumpArgs = append(dumpArgs, dbName)
-
-	case "mysql":
-		dumpCmd = "mysqldump"
-		dumpArgs = []string{
-			"--single-transaction",
-			"--routines",
-			"--triggers",
-			"--events",
-		}
-		if dedupDBHost != "" {
-			dumpArgs = append(dumpArgs, "-h", dedupDBHost)
-		}
-		if backupDBUser != "" {
-			dumpArgs = append(dumpArgs, "-u", backupDBUser)
-		}
-		if backupDBPassword != "" {
-			dumpArgs = append(dumpArgs, "-p"+backupDBPassword)
-		}
-		dumpArgs = append(dumpArgs, dbName)
-
-	case "mariadb":
-		dumpCmd = "mariadb-dump"
-		// Fall back to mysqldump if mariadb-dump not available
-		if _, err := exec.LookPath(dumpCmd); err != nil {
-			dumpCmd = "mysqldump"
-		}
-		dumpArgs = []string{
-			"--single-transaction",
-			"--routines",
-			"--triggers",
-			"--events",
-		}
-		if dedupDBHost != "" {
-			dumpArgs = append(dumpArgs, "-h", dedupDBHost)
-		}
-		if backupDBUser != "" {
-			dumpArgs = append(dumpArgs, "-u", backupDBUser)
-		}
-		if backupDBPassword != "" {
-			dumpArgs = append(dumpArgs, "-p"+backupDBPassword)
-		}
-		dumpArgs = append(dumpArgs, dbName)
-
-	default:
-		return fmt.Errorf("unsupported database type: %s (use postgres, mysql, or mariadb)", dbType)
-	}
-
-	// Verify dump command exists
-	if _, err := exec.LookPath(dumpCmd); err != nil {
-		return fmt.Errorf("%s not found in PATH: %w", dumpCmd, err)
-	}
-
-	// Setup dedup storage
-	basePath := getDedupDir()
-	encKey := ""
-	if dedupEncrypt {
-		encKey = getEncryptionKey()
-		if encKey == "" {
-			return fmt.Errorf("encryption enabled but no key provided (use --key or DBBACKUP_DEDUP_KEY)")
-		}
-	}
-
-	store, err := dedup.NewChunkStore(dedup.StoreConfig{
-		BasePath:      basePath,
-		Compress:      dedupCompress,
-		EncryptionKey: encKey,
-	})
-	if err != nil {
-		return fmt.Errorf("failed to open chunk store: %w", err)
-	}
-
-	manifestStore, err := dedup.NewManifestStore(basePath)
-	if err != nil {
-		return fmt.Errorf("failed to open manifest store: %w", err)
-	}
-
-	index, err := dedup.NewChunkIndexAt(getIndexDBPath())
-	if err != nil {
-		return fmt.Errorf("failed to open chunk index: %w", err)
-	}
-	defer index.Close()
-
-	// Generate manifest ID
-	now := time.Now()
-	manifestID := now.Format("2006-01-02_150405") + "_" + dbName
-
-	fmt.Printf("Creating deduplicated database backup: %s\n", manifestID)
-	fmt.Printf("Database: %s (%s)\n", dbName, dbType)
-	fmt.Printf("Command: %s %s\n", dumpCmd, strings.Join(dumpArgs, " "))
-	fmt.Printf("Store: %s\n", basePath)
-
-	// Start the dump command
-	dumpExec := exec.Command(dumpCmd, dumpArgs...)
-
-	// Set password via environment for postgres
-	if dbType == "postgres" && backupDBPassword != "" {
-		dumpExec.Env = append(os.Environ(), "PGPASSWORD="+backupDBPassword)
-	}
-
-	stdout, err := dumpExec.StdoutPipe()
-	if err != nil {
-		return fmt.Errorf("failed to get stdout pipe: %w", err)
-	}
-
-	stderr, err := dumpExec.StderrPipe()
-	if err != nil {
-		return fmt.Errorf("failed to get stderr pipe: %w", err)
-	}
-
-	if err := dumpExec.Start(); err != nil {
-		return fmt.Errorf("failed to start %s: %w", dumpCmd, err)
-	}
-
-	// Hash while chunking using TeeReader
-	h := sha256.New()
-	reader := io.TeeReader(stdout, h)
-
-	// Chunk the stream directly
-	chunker := dedup.NewChunker(reader, dedup.DefaultChunkerConfig())
-	var chunks []dedup.ChunkRef
-	var totalSize, storedSize int64
-	var chunkCount, newChunks int
-
-	startTime := time.Now()
-
-	for {
-		chunk, err := chunker.Next()
-		if err == io.EOF {
-			break
-		}
-		if err != nil {
-			return fmt.Errorf("chunking failed: %w", err)
-		}
-
-		chunkCount++
-		totalSize += int64(chunk.Length)
-
-		// Store chunk (deduplication happens here)
-		isNew, err := store.Put(chunk)
-		if err != nil {
-			return fmt.Errorf("failed to store chunk: %w", err)
-		}
-
-		if isNew {
-			newChunks++
-			storedSize += int64(chunk.Length)
-			index.AddChunk(chunk.Hash, chunk.Length, chunk.Length)
-		}
-
-		chunks = append(chunks, dedup.ChunkRef{
-			Hash:   chunk.Hash,
-			Offset: chunk.Offset,
-			Length: chunk.Length,
-		})
-
-		if chunkCount%1000 == 0 {
-			fmt.Printf("\r  Processed %d chunks, %d new, %s...", chunkCount, newChunks, formatBytes(totalSize))
-		}
-	}
-
-	// Read any stderr
-	stderrBytes, _ := io.ReadAll(stderr)
-
-	// Wait for command to complete
-	if err := dumpExec.Wait(); err != nil {
-		return fmt.Errorf("%s failed: %w\nstderr: %s", dumpCmd, err, string(stderrBytes))
-	}
-
-	duration := time.Since(startTime)
-	fileHash := hex.EncodeToString(h.Sum(nil))
-
-	// Calculate dedup ratio
-	dedupRatio := 0.0
-	if totalSize > 0 {
-		dedupRatio = 1.0 - float64(storedSize)/float64(totalSize)
-	}
-
-	// Create manifest
-	manifest := &dedup.Manifest{
-		ID:           manifestID,
-		Name:         dedupName,
-		CreatedAt:    now,
-		DatabaseType: dbType,
-		DatabaseName: dbName,
-		DatabaseHost: dedupDBHost,
-		Chunks:       chunks,
-		OriginalSize: totalSize,
-		StoredSize:   storedSize,
-		ChunkCount:   chunkCount,
-		NewChunks:    newChunks,
-		DedupRatio:   dedupRatio,
-		Encrypted:    dedupEncrypt,
-		Compressed:   dedupCompress,
-		SHA256:       fileHash,
-	}
-
-	if err := manifestStore.Save(manifest); err != nil {
-		return fmt.Errorf("failed to save manifest: %w", err)
-	}
-
-	if err := index.AddManifest(manifest); err != nil {
-		log.Warn("Failed to index manifest", "error", err)
-	}
-
-	fmt.Printf("\r                                                    \r")
-	fmt.Printf("\nBackup complete!\n")
-	fmt.Printf("  Manifest:    %s\n", manifestID)
-	fmt.Printf("  Chunks:      %d total, %d new\n", chunkCount, newChunks)
-	fmt.Printf("  Dump size:   %s\n", formatBytes(totalSize))
-	fmt.Printf("  Stored:      %s (new data)\n", formatBytes(storedSize))
-	fmt.Printf("  Dedup ratio: %.1f%%\n", dedupRatio*100)
-	fmt.Printf("  Duration:    %s\n", duration.Round(time.Millisecond))
-	fmt.Printf("  Throughput:  %s/s\n", formatBytes(int64(float64(totalSize)/duration.Seconds())))
-
-	return nil
-}
-
-func runDedupMetrics(cmd *cobra.Command, args []string) error {
-	basePath := getDedupDir()
-	indexPath := getIndexDBPath()
-
-	server := dedupMetricsServer
-	if server == "" {
-		hostname, _ := os.Hostname()
-		server = hostname
-	}
-
-	metrics, err := dedup.CollectMetrics(basePath, indexPath)
-	if err != nil {
-		return fmt.Errorf("failed to collect metrics: %w", err)
-	}
-
-	output := dedup.FormatPrometheusMetrics(metrics, server)
-
-	if dedupMetricsOutput != "" {
-		if err := dedup.WritePrometheusTextfile(dedupMetricsOutput, server, basePath, indexPath); err != nil {
-			return fmt.Errorf("failed to write metrics: %w", err)
-		}
-		fmt.Printf("Wrote metrics to %s\n", dedupMetricsOutput)
-	} else {
-		fmt.Print(output)
-	}
-
-	return nil
-}

cmd/drill.go

@@ -16,7 +16,8 @@ import (
 )
 
 var (
-	drillDatabaseName string
+	drillBackupPath     string
+	drillDatabaseName   string
 	drillDatabaseType   string
 	drillImage          string
 	drillPort           int

cmd/encryption.go

@@ -65,3 +65,13 @@ func loadEncryptionKey(keyFile, keyEnvVar string) ([]byte, error) {
 func isEncryptionEnabled() bool {
 	return encryptBackupFlag
 }
+
+// generateEncryptionKey generates a new random encryption key
+func generateEncryptionKey() ([]byte, error) {
+	salt, err := crypto.GenerateSalt()
+	if err != nil {
+		return nil, err
+	}
+	// For key generation, use salt as both password and salt (random)
+	return crypto.DeriveKey(salt, salt), nil
+}

cmd/health.go

@@ -1,699 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"dbbackup/internal/catalog"
-	"dbbackup/internal/database"
-
-	"github.com/spf13/cobra"
-)
-
-var (
-	healthFormat   string
-	healthVerbose  bool
-	healthInterval string
-	healthSkipDB   bool
-)
-
-// HealthStatus represents overall health
-type HealthStatus string
-
-const (
-	StatusHealthy  HealthStatus = "healthy"
-	StatusWarning  HealthStatus = "warning"
-	StatusCritical HealthStatus = "critical"
-)
-
-// HealthReport contains the complete health check results
-type HealthReport struct {
-	Status         HealthStatus          `json:"status"`
-	Timestamp      time.Time             `json:"timestamp"`
-	Summary        string                `json:"summary"`
-	Checks         []HealthCheck         `json:"checks"`
-	Recommendations []string             `json:"recommendations,omitempty"`
-}
-
-// HealthCheck represents a single health check
-type HealthCheck struct {
-	Name        string       `json:"name"`
-	Status      HealthStatus `json:"status"`
-	Message     string       `json:"message"`
-	Details     string       `json:"details,omitempty"`
-}
-
-// healthCmd is the health check command
-var healthCmd = &cobra.Command{
-	Use:   "health",
-	Short: "Check backup system health",
-	Long: `Comprehensive health check for your backup infrastructure.
-
-Checks:
-  - Database connectivity (can we reach the database?)
-  - Catalog integrity (is the backup database healthy?)
-  - Backup freshness (are backups up to date?)
-  - Gap detection (any missed scheduled backups?)
-  - Verification status (are backups verified?)
-  - File integrity (do backup files exist and match metadata?)
-  - Disk space (sufficient space for operations?)
-  - Configuration (valid settings?)
-
-Exit codes for automation:
-  0 = healthy (all checks passed)
-  1 = warning (some checks need attention)
-  2 = critical (immediate action required)
-
-Examples:
-  # Quick health check
-  dbbackup health
-
-  # Detailed output
-  dbbackup health --verbose
-
-  # JSON for monitoring integration
-  dbbackup health --format json
-
-  # Custom backup interval for gap detection
-  dbbackup health --interval 12h
-
-  # Skip database connectivity (offline check)
-  dbbackup health --skip-db`,
-	RunE: runHealthCheck,
-}
-
-func init() {
-	rootCmd.AddCommand(healthCmd)
-
-	healthCmd.Flags().StringVar(&healthFormat, "format", "table", "Output format (table, json)")
-	healthCmd.Flags().BoolVarP(&healthVerbose, "verbose", "v", false, "Show detailed output")
-	healthCmd.Flags().StringVar(&healthInterval, "interval", "24h", "Expected backup interval for gap detection")
-	healthCmd.Flags().BoolVar(&healthSkipDB, "skip-db", false, "Skip database connectivity check")
-}
-
-func runHealthCheck(cmd *cobra.Command, args []string) error {
-	report := &HealthReport{
-		Status:    StatusHealthy,
-		Timestamp: time.Now(),
-		Checks:    []HealthCheck{},
-	}
-
-	ctx := context.Background()
-
-	// Parse interval for gap detection
-	interval, err := time.ParseDuration(healthInterval)
-	if err != nil {
-		interval = 24 * time.Hour
-	}
-
-	// 1. Configuration check
-	report.addCheck(checkConfiguration())
-
-	// 2. Database connectivity (unless skipped)
-	if !healthSkipDB {
-		report.addCheck(checkDatabaseConnectivity(ctx))
-	}
-
-	// 3. Backup directory check
-	report.addCheck(checkBackupDir())
-
-	// 4. Catalog integrity check
-	catalogCheck, cat := checkCatalogIntegrity(ctx)
-	report.addCheck(catalogCheck)
-
-	if cat != nil {
-		defer cat.Close()
-
-		// 5. Backup freshness check
-		report.addCheck(checkBackupFreshness(ctx, cat, interval))
-
-		// 6. Gap detection
-		report.addCheck(checkBackupGaps(ctx, cat, interval))
-
-		// 7. Verification status
-		report.addCheck(checkVerificationStatus(ctx, cat))
-
-		// 8. File integrity (sampling)
-		report.addCheck(checkFileIntegrity(ctx, cat))
-
-		// 9. Orphaned entries
-		report.addCheck(checkOrphanedEntries(ctx, cat))
-	}
-
-	// 10. Disk space
-	report.addCheck(checkDiskSpace())
-
-	// Calculate overall status
-	report.calculateOverallStatus()
-
-	// Generate recommendations
-	report.generateRecommendations()
-
-	// Output
-	if healthFormat == "json" {
-		return outputHealthJSON(report)
-	}
-
-	outputHealthTable(report)
-
-	// Exit code based on status
-	switch report.Status {
-	case StatusWarning:
-		os.Exit(1)
-	case StatusCritical:
-		os.Exit(2)
-	}
-
-	return nil
-}
-
-func (r *HealthReport) addCheck(check HealthCheck) {
-	r.Checks = append(r.Checks, check)
-}
-
-func (r *HealthReport) calculateOverallStatus() {
-	criticalCount := 0
-	warningCount := 0
-	healthyCount := 0
-
-	for _, check := range r.Checks {
-		switch check.Status {
-		case StatusCritical:
-			criticalCount++
-		case StatusWarning:
-			warningCount++
-		case StatusHealthy:
-			healthyCount++
-		}
-	}
-
-	if criticalCount > 0 {
-		r.Status = StatusCritical
-		r.Summary = fmt.Sprintf("%d critical, %d warning, %d healthy", criticalCount, warningCount, healthyCount)
-	} else if warningCount > 0 {
-		r.Status = StatusWarning
-		r.Summary = fmt.Sprintf("%d warning, %d healthy", warningCount, healthyCount)
-	} else {
-		r.Status = StatusHealthy
-		r.Summary = fmt.Sprintf("All %d checks passed", healthyCount)
-	}
-}
-
-func (r *HealthReport) generateRecommendations() {
-	for _, check := range r.Checks {
-		switch {
-		case check.Name == "Backup Freshness" && check.Status != StatusHealthy:
-			r.Recommendations = append(r.Recommendations, "Run a backup immediately: dbbackup backup cluster")
-		case check.Name == "Verification Status" && check.Status != StatusHealthy:
-			r.Recommendations = append(r.Recommendations, "Verify recent backups: dbbackup verify-backup /path/to/backup")
-		case check.Name == "Disk Space" && check.Status != StatusHealthy:
-			r.Recommendations = append(r.Recommendations, "Free up disk space or run cleanup: dbbackup cleanup")
-		case check.Name == "Backup Gaps" && check.Status == StatusCritical:
-			r.Recommendations = append(r.Recommendations, "Review backup schedule and cron configuration")
-		case check.Name == "Orphaned Entries" && check.Status != StatusHealthy:
-			r.Recommendations = append(r.Recommendations, "Clean orphaned entries: dbbackup catalog cleanup --orphaned")
-		case check.Name == "Database Connectivity" && check.Status != StatusHealthy:
-			r.Recommendations = append(r.Recommendations, "Check database connection settings in .dbbackup.conf")
-		}
-	}
-}
-
-// Individual health checks
-
-func checkConfiguration() HealthCheck {
-	check := HealthCheck{
-		Name:   "Configuration",
-		Status: StatusHealthy,
-	}
-
-	if err := cfg.Validate(); err != nil {
-		check.Status = StatusCritical
-		check.Message = "Configuration invalid"
-		check.Details = err.Error()
-		return check
-	}
-
-	check.Message = "Configuration valid"
-	return check
-}
-
-func checkDatabaseConnectivity(ctx context.Context) HealthCheck {
-	check := HealthCheck{
-		Name:   "Database Connectivity",
-		Status: StatusHealthy,
-	}
-
-	db, err := database.New(cfg, log)
-	if err != nil {
-		check.Status = StatusCritical
-		check.Message = "Failed to create database instance"
-		check.Details = err.Error()
-		return check
-	}
-	defer db.Close()
-
-	if err := db.Connect(ctx); err != nil {
-		check.Status = StatusCritical
-		check.Message = "Cannot connect to database"
-		check.Details = err.Error()
-		return check
-	}
-
-	version, _ := db.GetVersion(ctx)
-	check.Message = "Connected successfully"
-	check.Details = version
-
-	return check
-}
-
-func checkBackupDir() HealthCheck {
-	check := HealthCheck{
-		Name:   "Backup Directory",
-		Status: StatusHealthy,
-	}
-
-	info, err := os.Stat(cfg.BackupDir)
-	if err != nil {
-		if os.IsNotExist(err) {
-			check.Status = StatusWarning
-			check.Message = "Backup directory does not exist"
-			check.Details = cfg.BackupDir
-		} else {
-			check.Status = StatusCritical
-			check.Message = "Cannot access backup directory"
-			check.Details = err.Error()
-		}
-		return check
-	}
-
-	if !info.IsDir() {
-		check.Status = StatusCritical
-		check.Message = "Backup path is not a directory"
-		check.Details = cfg.BackupDir
-		return check
-	}
-
-	// Check writability
-	testFile := filepath.Join(cfg.BackupDir, ".health_check_test")
-	if err := os.WriteFile(testFile, []byte("test"), 0644); err != nil {
-		check.Status = StatusCritical
-		check.Message = "Backup directory is not writable"
-		check.Details = err.Error()
-		return check
-	}
-	os.Remove(testFile)
-
-	check.Message = "Backup directory accessible"
-	check.Details = cfg.BackupDir
-
-	return check
-}
-
-func checkCatalogIntegrity(ctx context.Context) (HealthCheck, *catalog.SQLiteCatalog) {
-	check := HealthCheck{
-		Name:   "Catalog Integrity",
-		Status: StatusHealthy,
-	}
-
-	cat, err := openCatalog()
-	if err != nil {
-		check.Status = StatusWarning
-		check.Message = "Catalog not available"
-		check.Details = err.Error()
-		return check, nil
-	}
-
-	// Try a simple query to verify integrity
-	stats, err := cat.Stats(ctx)
-	if err != nil {
-		check.Status = StatusCritical
-		check.Message = "Catalog corrupted or inaccessible"
-		check.Details = err.Error()
-		cat.Close()
-		return check, nil
-	}
-
-	check.Message = fmt.Sprintf("Catalog healthy (%d backups tracked)", stats.TotalBackups)
-	check.Details = fmt.Sprintf("Size: %s", stats.TotalSizeHuman)
-
-	return check, cat
-}
-
-func checkBackupFreshness(ctx context.Context, cat *catalog.SQLiteCatalog, interval time.Duration) HealthCheck {
-	check := HealthCheck{
-		Name:   "Backup Freshness",
-		Status: StatusHealthy,
-	}
-
-	stats, err := cat.Stats(ctx)
-	if err != nil {
-		check.Status = StatusWarning
-		check.Message = "Cannot determine backup freshness"
-		check.Details = err.Error()
-		return check
-	}
-
-	if stats.NewestBackup == nil {
-		check.Status = StatusCritical
-		check.Message = "No backups found in catalog"
-		return check
-	}
-
-	age := time.Since(*stats.NewestBackup)
-
-	if age > interval*3 {
-		check.Status = StatusCritical
-		check.Message = fmt.Sprintf("Last backup is %s old (critical)", formatDurationHealth(age))
-		check.Details = stats.NewestBackup.Format("2006-01-02 15:04:05")
-	} else if age > interval {
-		check.Status = StatusWarning
-		check.Message = fmt.Sprintf("Last backup is %s old", formatDurationHealth(age))
-		check.Details = stats.NewestBackup.Format("2006-01-02 15:04:05")
-	} else {
-		check.Message = fmt.Sprintf("Last backup %s ago", formatDurationHealth(age))
-		check.Details = stats.NewestBackup.Format("2006-01-02 15:04:05")
-	}
-
-	return check
-}
-
-func checkBackupGaps(ctx context.Context, cat *catalog.SQLiteCatalog, interval time.Duration) HealthCheck {
-	check := HealthCheck{
-		Name:   "Backup Gaps",
-		Status: StatusHealthy,
-	}
-
-	config := &catalog.GapDetectionConfig{
-		ExpectedInterval: interval,
-		Tolerance:        interval / 4,
-		RPOThreshold:     interval * 2,
-	}
-
-	allGaps, err := cat.DetectAllGaps(ctx, config)
-	if err != nil {
-		check.Status = StatusWarning
-		check.Message = "Gap detection failed"
-		check.Details = err.Error()
-		return check
-	}
-
-	totalGaps := 0
-	criticalGaps := 0
-	for _, gaps := range allGaps {
-		totalGaps += len(gaps)
-		for _, gap := range gaps {
-			if gap.Severity == catalog.SeverityCritical {
-				criticalGaps++
-			}
-		}
-	}
-
-	if criticalGaps > 0 {
-		check.Status = StatusCritical
-		check.Message = fmt.Sprintf("%d critical gaps detected", criticalGaps)
-		check.Details = fmt.Sprintf("%d total gaps across %d databases", totalGaps, len(allGaps))
-	} else if totalGaps > 0 {
-		check.Status = StatusWarning
-		check.Message = fmt.Sprintf("%d gaps detected", totalGaps)
-		check.Details = fmt.Sprintf("Across %d databases", len(allGaps))
-	} else {
-		check.Message = "No backup gaps detected"
-	}
-
-	return check
-}
-
-func checkVerificationStatus(ctx context.Context, cat *catalog.SQLiteCatalog) HealthCheck {
-	check := HealthCheck{
-		Name:   "Verification Status",
-		Status: StatusHealthy,
-	}
-
-	stats, err := cat.Stats(ctx)
-	if err != nil {
-		check.Status = StatusWarning
-		check.Message = "Cannot check verification status"
-		return check
-	}
-
-	if stats.TotalBackups == 0 {
-		check.Message = "No backups to verify"
-		return check
-	}
-
-	verifiedPct := float64(stats.VerifiedCount) / float64(stats.TotalBackups) * 100
-
-	if verifiedPct < 25 {
-		check.Status = StatusWarning
-		check.Message = fmt.Sprintf("Only %.0f%% of backups verified", verifiedPct)
-		check.Details = fmt.Sprintf("%d/%d verified", stats.VerifiedCount, stats.TotalBackups)
-	} else {
-		check.Message = fmt.Sprintf("%.0f%% of backups verified", verifiedPct)
-		check.Details = fmt.Sprintf("%d/%d verified", stats.VerifiedCount, stats.TotalBackups)
-	}
-
-	// Check drill testing status too
-	if stats.DrillTestedCount > 0 {
-		check.Details += fmt.Sprintf(", %d drill tested", stats.DrillTestedCount)
-	}
-
-	return check
-}
-
-func checkFileIntegrity(ctx context.Context, cat *catalog.SQLiteCatalog) HealthCheck {
-	check := HealthCheck{
-		Name:   "File Integrity",
-		Status: StatusHealthy,
-	}
-
-	// Sample recent backups for file existence
-	entries, err := cat.Search(ctx, &catalog.SearchQuery{
-		Limit:     10,
-		OrderBy:   "created_at",
-		OrderDesc: true,
-	})
-	if err != nil || len(entries) == 0 {
-		check.Message = "No backups to check"
-		return check
-	}
-
-	missingCount := 0
-	checksumMismatch := 0
-
-	for _, entry := range entries {
-		// Skip cloud backups
-		if entry.CloudLocation != "" {
-			continue
-		}
-
-		// Check file exists
-		info, err := os.Stat(entry.BackupPath)
-		if err != nil {
-			missingCount++
-			continue
-		}
-
-		// Quick size check
-		if info.Size() != entry.SizeBytes {
-			checksumMismatch++
-		}
-	}
-
-	totalChecked := len(entries)
-
-	if missingCount > 0 {
-		check.Status = StatusCritical
-		check.Message = fmt.Sprintf("%d/%d backup files missing", missingCount, totalChecked)
-	} else if checksumMismatch > 0 {
-		check.Status = StatusWarning
-		check.Message = fmt.Sprintf("%d/%d backups have size mismatch", checksumMismatch, totalChecked)
-	} else {
-		check.Message = fmt.Sprintf("Sampled %d recent backups - all present", totalChecked)
-	}
-
-	return check
-}
-
-func checkOrphanedEntries(ctx context.Context, cat *catalog.SQLiteCatalog) HealthCheck {
-	check := HealthCheck{
-		Name:   "Orphaned Entries",
-		Status: StatusHealthy,
-	}
-
-	// Check for catalog entries pointing to missing files
-	entries, err := cat.Search(ctx, &catalog.SearchQuery{
-		Limit:     50,
-		OrderBy:   "created_at",
-		OrderDesc: true,
-	})
-	if err != nil {
-		check.Message = "Cannot check for orphaned entries"
-		return check
-	}
-
-	orphanCount := 0
-	for _, entry := range entries {
-		if entry.CloudLocation != "" {
-			continue // Skip cloud backups
-		}
-		if _, err := os.Stat(entry.BackupPath); os.IsNotExist(err) {
-			orphanCount++
-		}
-	}
-
-	if orphanCount > 0 {
-		check.Status = StatusWarning
-		check.Message = fmt.Sprintf("%d orphaned catalog entries", orphanCount)
-		check.Details = "Files deleted but entries remain in catalog"
-	} else {
-		check.Message = "No orphaned entries detected"
-	}
-
-	return check
-}
-
-func checkDiskSpace() HealthCheck {
-	check := HealthCheck{
-		Name:   "Disk Space",
-		Status: StatusHealthy,
-	}
-
-	// Simple approach: check if we can write a test file
-	testPath := filepath.Join(cfg.BackupDir, ".space_check")
-	
-	// Create a 1MB test to ensure we have space
-	testData := make([]byte, 1024*1024)
-	if err := os.WriteFile(testPath, testData, 0644); err != nil {
-		check.Status = StatusCritical
-		check.Message = "Insufficient disk space or write error"
-		check.Details = err.Error()
-		return check
-	}
-	os.Remove(testPath)
-
-	// Try to get actual free space (Linux-specific)
-	info, err := os.Stat(cfg.BackupDir)
-	if err == nil && info.IsDir() {
-		// Walk the backup directory to get size
-		var totalSize int64
-		filepath.Walk(cfg.BackupDir, func(path string, info os.FileInfo, err error) error {
-			if err == nil && !info.IsDir() {
-				totalSize += info.Size()
-			}
-			return nil
-		})
-
-		check.Message = "Disk space available"
-		check.Details = fmt.Sprintf("Backup directory using %s", formatBytesHealth(totalSize))
-	} else {
-		check.Message = "Disk space available"
-	}
-
-	return check
-}
-
-// Output functions
-
-func outputHealthTable(report *HealthReport) {
-	fmt.Println()
-	
-	statusIcon := "✅"
-	statusColor := "\033[32m" // green
-	if report.Status == StatusWarning {
-		statusIcon = "⚠️"
-		statusColor = "\033[33m" // yellow
-	} else if report.Status == StatusCritical {
-		statusIcon = "🚨"
-		statusColor = "\033[31m" // red
-	}
-
-	fmt.Println("═══════════════════════════════════════════════════════════════")
-	fmt.Printf("  %s Backup Health Check\n", statusIcon)
-	fmt.Println("═══════════════════════════════════════════════════════════════")
-	fmt.Println()
-
-	fmt.Printf("Status: %s%s\033[0m\n", statusColor, strings.ToUpper(string(report.Status)))
-	fmt.Printf("Time:   %s\n", report.Timestamp.Format("2006-01-02 15:04:05"))
-	fmt.Println()
-
-	fmt.Println("───────────────────────────────────────────────────────────────")
-	fmt.Println("CHECKS")
-	fmt.Println("───────────────────────────────────────────────────────────────")
-
-	for _, check := range report.Checks {
-		icon := "✓"
-		color := "\033[32m"
-		if check.Status == StatusWarning {
-			icon = "!"
-			color = "\033[33m"
-		} else if check.Status == StatusCritical {
-			icon = "✗"
-			color = "\033[31m"
-		}
-
-		fmt.Printf("%s[%s]\033[0m %-22s %s\n", color, icon, check.Name, check.Message)
-		
-		if healthVerbose && check.Details != "" {
-			fmt.Printf("      └─ %s\n", check.Details)
-		}
-	}
-
-	fmt.Println()
-	fmt.Println("───────────────────────────────────────────────────────────────")
-	fmt.Printf("Summary: %s\n", report.Summary)
-	fmt.Println("───────────────────────────────────────────────────────────────")
-
-	if len(report.Recommendations) > 0 {
-		fmt.Println()
-		fmt.Println("RECOMMENDATIONS")
-		for _, rec := range report.Recommendations {
-			fmt.Printf("  → %s\n", rec)
-		}
-	}
-
-	fmt.Println()
-}
-
-func outputHealthJSON(report *HealthReport) error {
-	data, err := json.MarshalIndent(report, "", "  ")
-	if err != nil {
-		return err
-	}
-	fmt.Println(string(data))
-	return nil
-}
-
-// Helpers
-
-func formatDurationHealth(d time.Duration) string {
-	if d < time.Minute {
-		return fmt.Sprintf("%.0fs", d.Seconds())
-	}
-	if d < time.Hour {
-		return fmt.Sprintf("%.0fm", d.Minutes())
-	}
-	hours := int(d.Hours())
-	if hours < 24 {
-		return fmt.Sprintf("%dh", hours)
-	}
-	days := hours / 24
-	return fmt.Sprintf("%dd %dh", days, hours%24)
-}
-
-func formatBytesHealth(bytes int64) string {
-	const unit = 1024
-	if bytes < unit {
-		return fmt.Sprintf("%d B", bytes)
-	}
-	div, exp := int64(unit), 0
-	for n := bytes / unit; n >= unit; n /= unit {
-		div *= unit
-		exp++
-	}
-	return fmt.Sprintf("%.1f %cB", float64(bytes)/float64(div), "KMGTPE"[exp])
-}

cmd/metrics.go

@@ -5,19 +5,17 @@ import (
 	"fmt"
 	"os"
 	"os/signal"
-	"path/filepath"
 	"syscall"
 
-	"dbbackup/internal/catalog"
 	"dbbackup/internal/prometheus"
 
 	"github.com/spf13/cobra"
 )
 
 var (
-	metricsServer string
-	metricsOutput string
-	metricsPort   int
+	metricsInstance string
+	metricsOutput   string
+	metricsPort     int
 )
 
 // metricsCmd represents the metrics command
@@ -47,7 +45,7 @@ Examples:
   dbbackup metrics export --output /var/lib/dbbackup/metrics/dbbackup.prom
 
   # Export for specific instance
-  dbbackup metrics export --server production --output /var/lib/dbbackup/metrics/production.prom
+  dbbackup metrics export --instance production --output /var/lib/dbbackup/metrics/production.prom
 
 After export, configure node_exporter with:
   --collector.textfile.directory=/var/lib/dbbackup/metrics/
@@ -86,56 +84,37 @@ Endpoints:
 	},
 }
 
-var metricsCatalogDB string
-
 func init() {
 	rootCmd.AddCommand(metricsCmd)
 	metricsCmd.AddCommand(metricsExportCmd)
 	metricsCmd.AddCommand(metricsServeCmd)
 
-	// Default catalog path (same as catalog command)
-	home, _ := os.UserHomeDir()
-	defaultCatalogPath := filepath.Join(home, ".dbbackup", "catalog.db")
-
 	// Export flags
-	metricsExportCmd.Flags().StringVar(&metricsServer, "server", "", "Server name for metrics labels (default: hostname)")
+	metricsExportCmd.Flags().StringVar(&metricsInstance, "instance", "default", "Instance name for metrics labels")
 	metricsExportCmd.Flags().StringVarP(&metricsOutput, "output", "o", "/var/lib/dbbackup/metrics/dbbackup.prom", "Output file path")
-	metricsExportCmd.Flags().StringVar(&metricsCatalogDB, "catalog-db", defaultCatalogPath, "Path to catalog SQLite database")
 
 	// Serve flags
-	metricsServeCmd.Flags().StringVar(&metricsServer, "server", "", "Server name for metrics labels (default: hostname)")
+	metricsServeCmd.Flags().StringVar(&metricsInstance, "instance", "default", "Instance name for metrics labels")
 	metricsServeCmd.Flags().IntVarP(&metricsPort, "port", "p", 9399, "HTTP server port")
-	metricsServeCmd.Flags().StringVar(&metricsCatalogDB, "catalog-db", defaultCatalogPath, "Path to catalog SQLite database")
 }
 
 func runMetricsExport(ctx context.Context) error {
-	// Auto-detect hostname if server not specified
-	server := metricsServer
-	if server == "" {
-		hostname, err := os.Hostname()
-		if err != nil {
-			server = "unknown"
-		} else {
-			server = hostname
-		}
-	}
-
-	// Open catalog using specified path
-	cat, err := catalog.NewSQLiteCatalog(metricsCatalogDB)
+	// Open catalog
+	cat, err := openCatalog()
 	if err != nil {
 		return fmt.Errorf("failed to open catalog: %w", err)
 	}
 	defer cat.Close()
 
-	// Create metrics writer with version info
-	writer := prometheus.NewMetricsWriterWithVersion(log, cat, server, cfg.Version, cfg.GitCommit)
+	// Create metrics writer
+	writer := prometheus.NewMetricsWriter(log, cat, metricsInstance)
 
 	// Write textfile
 	if err := writer.WriteTextfile(metricsOutput); err != nil {
 		return fmt.Errorf("failed to write metrics: %w", err)
 	}
 
-	log.Info("Exported metrics to textfile", "path", metricsOutput, "server", server)
+	log.Info("Exported metrics to textfile", "path", metricsOutput, "instance", metricsInstance)
 	return nil
 }
 
@@ -144,26 +123,15 @@ func runMetricsServe(ctx context.Context) error {
 	ctx, cancel := signal.NotifyContext(ctx, os.Interrupt, syscall.SIGTERM)
 	defer cancel()
 
-	// Auto-detect hostname if server not specified
-	server := metricsServer
-	if server == "" {
-		hostname, err := os.Hostname()
-		if err != nil {
-			server = "unknown"
-		} else {
-			server = hostname
-		}
-	}
-
-	// Open catalog using specified path
-	cat, err := catalog.NewSQLiteCatalog(metricsCatalogDB)
+	// Open catalog
+	cat, err := openCatalog()
 	if err != nil {
 		return fmt.Errorf("failed to open catalog: %w", err)
 	}
 	defer cat.Close()
 
-	// Create exporter with version info
-	exporter := prometheus.NewExporterWithVersion(log, cat, server, metricsPort, cfg.Version, cfg.GitCommit)
+	// Create exporter
+	exporter := prometheus.NewExporter(log, cat, metricsInstance, metricsPort)
 
 	// Run server (blocks until context is cancelled)
 	return exporter.Serve(ctx)

cmd/pitr.go

@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"fmt"
 	"os"
+	"path/filepath"
 	"time"
 
 	"github.com/spf13/cobra"
@@ -43,6 +44,7 @@ var (
 	mysqlArchiveInterval  string
 	mysqlRequireRowFormat bool
 	mysqlRequireGTID      bool
+	mysqlWatchMode        bool
 )
 
 // pitrCmd represents the pitr command group
@@ -1309,3 +1311,14 @@ func runMySQLPITREnable(cmd *cobra.Command, args []string) error {
 
 	return nil
 }
+
+// getMySQLBinlogDir attempts to determine the binlog directory from MySQL
+func getMySQLBinlogDir(ctx context.Context, db *sql.DB) (string, error) {
+	var logBinBasename string
+	err := db.QueryRowContext(ctx, "SELECT @@log_bin_basename").Scan(&logBinBasename)
+	if err != nil {
+		return "", err
+	}
+
+	return filepath.Dir(logBinBasename), nil
+}

cmd/placeholder.go

@@ -1,6 +1,7 @@
 package cmd
 
 import (
+	"compress/gzip"
 	"context"
 	"fmt"
 	"io"
@@ -14,7 +15,6 @@ import (
 	"dbbackup/internal/logger"
 	"dbbackup/internal/tui"
 
-	"github.com/klauspost/pgzip"
 	"github.com/spf13/cobra"
 )
 
@@ -66,22 +66,6 @@ TUI Automation Flags (for testing and CI/CD):
 		cfg.TUIVerbose, _ = cmd.Flags().GetBool("verbose-tui")
 		cfg.TUILogFile, _ = cmd.Flags().GetString("tui-log-file")
 
-		// FIXED: Only set default profile if user hasn't configured one
-		// Previously this forced conservative mode, ignoring user's saved settings
-		if cfg.ResourceProfile == "" {
-			// No profile configured at all - use balanced as sensible default
-			cfg.ResourceProfile = "balanced"
-			if cfg.Debug {
-				log.Info("TUI mode: no profile configured, using 'balanced' default")
-			}
-		} else {
-			// User has a configured profile - RESPECT IT!
-			if cfg.Debug {
-				log.Info("TUI mode: respecting user-configured profile", "profile", cfg.ResourceProfile)
-			}
-		}
-		// Note: LargeDBMode is no longer forced - user controls it via settings
-
 		// Check authentication before starting TUI
 		if cfg.IsPostgreSQL() {
 			if mismatch, msg := auth.CheckAuthenticationMismatch(cfg); mismatch {
@@ -281,7 +265,7 @@ func runPreflight(ctx context.Context) error {
 
 	// 4. Disk space check
 	fmt.Print("[4] Available disk space... ")
-	if err := checkPreflightDiskSpace(); err != nil {
+	if err := checkDiskSpace(); err != nil {
 		fmt.Printf("[FAIL] FAILED: %v\n", err)
 	} else {
 		fmt.Println("[OK] PASSED")
@@ -361,7 +345,7 @@ func checkBackupDirectory() error {
 	return nil
 }
 
-func checkPreflightDiskSpace() error {
+func checkDiskSpace() error {
 	// Basic disk space check - this is a simplified version
 	// In a real implementation, you'd use syscall.Statfs or similar
 	if _, err := os.Stat(cfg.BackupDir); os.IsNotExist(err) {
@@ -398,6 +382,92 @@ func checkSystemResources() error {
 	return nil
 }
 
+// runRestore restores database from backup archive
+func runRestore(ctx context.Context, archiveName string) error {
+	fmt.Println("==============================================================")
+	fmt.Println(" Database Restore")
+	fmt.Println("==============================================================")
+
+	// Construct full path to archive
+	archivePath := filepath.Join(cfg.BackupDir, archiveName)
+
+	// Check if archive exists
+	if _, err := os.Stat(archivePath); os.IsNotExist(err) {
+		return fmt.Errorf("backup archive not found: %s", archivePath)
+	}
+
+	// Detect archive type
+	archiveType := detectArchiveType(archiveName)
+	fmt.Printf("Archive: %s\n", archiveName)
+	fmt.Printf("Type: %s\n", archiveType)
+	fmt.Printf("Location: %s\n", archivePath)
+	fmt.Println()
+
+	// Get archive info
+	stat, err := os.Stat(archivePath)
+	if err != nil {
+		return fmt.Errorf("cannot access archive: %w", err)
+	}
+
+	fmt.Printf("Size: %s\n", formatFileSize(stat.Size()))
+	fmt.Printf("Created: %s\n", stat.ModTime().Format("2006-01-02 15:04:05"))
+	fmt.Println()
+
+	// Show warning
+	fmt.Println("[WARN] WARNING: This will restore data to the target database.")
+	fmt.Println("   Existing data may be overwritten or merged depending on the restore method.")
+	fmt.Println()
+
+	// For safety, show what would be done without actually doing it
+	switch archiveType {
+	case "Single Database (.dump)":
+		fmt.Println("[EXEC] Would execute: pg_restore to restore single database")
+		fmt.Printf("   Command: pg_restore -h %s -p %d -U %s -d %s --verbose %s\n",
+			cfg.Host, cfg.Port, cfg.User, cfg.Database, archivePath)
+	case "Single Database (.dump.gz)":
+		fmt.Println("[EXEC] Would execute: gunzip and pg_restore to restore single database")
+		fmt.Printf("   Command: gunzip -c %s | pg_restore -h %s -p %d -U %s -d %s --verbose\n",
+			archivePath, cfg.Host, cfg.Port, cfg.User, cfg.Database)
+	case "SQL Script (.sql)":
+		if cfg.IsPostgreSQL() {
+			fmt.Println("[EXEC] Would execute: psql to run SQL script")
+			fmt.Printf("   Command: psql -h %s -p %d -U %s -d %s -f %s\n",
+				cfg.Host, cfg.Port, cfg.User, cfg.Database, archivePath)
+		} else if cfg.IsMySQL() {
+			fmt.Println("[EXEC] Would execute: mysql to run SQL script")
+			fmt.Printf("   Command: %s\n", mysqlRestoreCommand(archivePath, false))
+		} else {
+			fmt.Println("[EXEC] Would execute: SQL client to run script (database type unknown)")
+		}
+	case "SQL Script (.sql.gz)":
+		if cfg.IsPostgreSQL() {
+			fmt.Println("[EXEC] Would execute: gunzip and psql to run SQL script")
+			fmt.Printf("   Command: gunzip -c %s | psql -h %s -p %d -U %s -d %s\n",
+				archivePath, cfg.Host, cfg.Port, cfg.User, cfg.Database)
+		} else if cfg.IsMySQL() {
+			fmt.Println("[EXEC] Would execute: gunzip and mysql to run SQL script")
+			fmt.Printf("   Command: %s\n", mysqlRestoreCommand(archivePath, true))
+		} else {
+			fmt.Println("[EXEC] Would execute: gunzip and SQL client to run script (database type unknown)")
+		}
+	case "Cluster Backup (.tar.gz)":
+		fmt.Println("[EXEC] Would execute: Extract and restore cluster backup")
+		fmt.Println("   Steps:")
+		fmt.Println("   1. Extract tar.gz archive")
+		fmt.Println("   2. Restore global objects (roles, tablespaces)")
+		fmt.Println("   3. Restore individual databases")
+	default:
+		return fmt.Errorf("unsupported archive type: %s", archiveType)
+	}
+
+	fmt.Println()
+	fmt.Println("[SAFETY] SAFETY MODE: Restore command is in preview mode.")
+	fmt.Println("   This shows what would be executed without making changes.")
+	fmt.Println("   To enable actual restore, add --confirm flag (not yet implemented).")
+
+	return nil
+}
+
 func detectArchiveType(filename string) string {
 	switch {
 	case strings.HasSuffix(filename, ".dump.gz"):
@@ -579,7 +649,7 @@ func verifyPgDumpGzip(path string) error {
 	}
 	defer file.Close()
 
-	gz, err := pgzip.NewReader(file)
+	gz, err := gzip.NewReader(file)
 	if err != nil {
 		return fmt.Errorf("failed to open gzip stream: %w", err)
 	}
@@ -628,7 +698,7 @@ func verifyGzipSqlScript(path string) error {
 	}
 	defer file.Close()
 
-	gz, err := pgzip.NewReader(file)
+	gz, err := gzip.NewReader(file)
 	if err != nil {
 		return fmt.Errorf("failed to open gzip stream: %w", err)
 	}
@@ -696,3 +766,33 @@ func containsSQLKeywords(content string) bool {
 
 	return false
 }
+
+func mysqlRestoreCommand(archivePath string, compressed bool) string {
+	parts := []string{"mysql"}
+
+	// Only add -h flag if host is not localhost (to use Unix socket)
+	if cfg.Host != "localhost" && cfg.Host != "127.0.0.1" && cfg.Host != "" {
+		parts = append(parts, "-h", cfg.Host)
+	}
+
+	parts = append(parts,
+		"-P", fmt.Sprintf("%d", cfg.Port),
+		"-u", cfg.User,
+	)
+
+	if cfg.Password != "" {
+		parts = append(parts, fmt.Sprintf("-p'%s'", cfg.Password))
+	}
+
+	if cfg.Database != "" {
+		parts = append(parts, cfg.Database)
+	}
+
+	command := strings.Join(parts, " ")
+
+	if compressed {
+		return fmt.Sprintf("gunzip -c %s | %s", archivePath, command)
+	}
+
+	return fmt.Sprintf("%s < %s", command, archivePath)
+}

cmd/restore.go

@@ -13,11 +13,8 @@ import (
 
 	"dbbackup/internal/backup"
 	"dbbackup/internal/cloud"
-	"dbbackup/internal/config"
 	"dbbackup/internal/database"
-	"dbbackup/internal/notify"
 	"dbbackup/internal/pitr"
-	"dbbackup/internal/progress"
 	"dbbackup/internal/restore"
 	"dbbackup/internal/security"
 
@@ -25,30 +22,19 @@ import (
 )
 
 var (
-	restoreConfirm       bool
-	restoreDryRun        bool
-	restoreForce         bool
-	restoreClean         bool
-	restoreCreate        bool
-	restoreJobs          int
-	restoreParallelDBs   int    // Number of parallel database restores
-	restoreProfile       string // Resource profile: conservative, balanced, aggressive
-	restoreTarget        string
-	restoreVerbose       bool
-	restoreNoProgress    bool
-	restoreWorkdir       string
-	restoreCleanCluster  bool
-	restoreDiagnose      bool   // Run diagnosis before restore
-	restoreSaveDebugLog  string // Path to save debug log on failure
-	restoreDebugLocks    bool   // Enable detailed lock debugging
-	restoreOOMProtection bool   // Enable OOM protection for large restores
-	restoreLowMemory     bool   // Force low-memory mode for constrained systems
-
-	// Single database extraction from cluster flags
-	restoreDatabase  string // Single database to extract/restore from cluster
-	restoreDatabases string // Comma-separated list of databases to extract
-	restoreOutputDir string // Extract to directory (no restore)
-	restoreListDBs   bool   // List databases in cluster backup
+	restoreConfirm      bool
+	restoreDryRun       bool
+	restoreForce        bool
+	restoreClean        bool
+	restoreCreate       bool
+	restoreJobs         int
+	restoreTarget       string
+	restoreVerbose      bool
+	restoreNoProgress   bool
+	restoreWorkdir      string
+	restoreCleanCluster bool
+	restoreDiagnose     bool   // Run diagnosis before restore
+	restoreSaveDebugLog string // Path to save debug log on failure
 
 	// Diagnose flags
 	diagnoseJSON     bool
@@ -125,9 +111,6 @@ Examples:
   # Restore to different database
   dbbackup restore single mydb.dump.gz --target mydb_test --confirm
 
-  # Memory-constrained server (single-threaded, minimal memory)
-  dbbackup restore single mydb.dump.gz --profile=conservative --confirm
-
   # Clean target database before restore
   dbbackup restore single mydb.sql.gz --clean --confirm
 
@@ -147,11 +130,6 @@ var restoreClusterCmd = &cobra.Command{
 This command restores all databases that were backed up together
 in a cluster backup operation.
 
-Single Database Extraction:
-  Use --list-databases to see available databases
-  Use --database to extract/restore a specific database
-  Use --output-dir to extract without restoring
-
 Safety features:
   - Dry-run by default (use --confirm to execute)
   - Archive validation and listing
@@ -159,33 +137,12 @@ Safety features:
   - Sequential database restoration
 
 Examples:
-  # List databases in cluster backup
-  dbbackup restore cluster backup.tar.gz --list-databases
-
-  # Extract single database (no restore)
-  dbbackup restore cluster backup.tar.gz --database myapp --output-dir /tmp/extract
-
-  # Restore single database from cluster
-  dbbackup restore cluster backup.tar.gz --database myapp --confirm
-
-  # Restore single database with different name
-  dbbackup restore cluster backup.tar.gz --database myapp --target myapp_test --confirm
-
-  # Extract multiple databases
-  dbbackup restore cluster backup.tar.gz --databases "app1,app2,app3" --output-dir /tmp/extract
-
   # Preview cluster restore
   dbbackup restore cluster cluster_backup_20240101_120000.tar.gz
 
   # Restore full cluster
   dbbackup restore cluster cluster_backup_20240101_120000.tar.gz --confirm
 
-	# Memory-constrained server (conservative profile)
-	dbbackup restore cluster cluster_backup.tar.gz --profile=conservative --confirm
-
-	# Maximum performance (dedicated server)
-	dbbackup restore cluster cluster_backup.tar.gz --profile=aggressive --confirm
-
 	# Use parallel decompression
 	dbbackup restore cluster cluster_backup.tar.gz --jobs 4 --confirm
 
@@ -282,7 +239,7 @@ Use this when:
 Checks performed:
   - File format detection (custom dump vs SQL)
   - PGDMP signature verification
-  - Compression integrity validation (pgzip)
+  - Gzip integrity validation
   - COPY block termination check
   - pg_restore --list verification
   - Cluster archive structure validation
@@ -319,27 +276,19 @@ func init() {
 	restoreSingleCmd.Flags().BoolVar(&restoreClean, "clean", false, "Drop and recreate target database")
 	restoreSingleCmd.Flags().BoolVar(&restoreCreate, "create", false, "Create target database if it doesn't exist")
 	restoreSingleCmd.Flags().StringVar(&restoreTarget, "target", "", "Target database name (defaults to original)")
-	restoreSingleCmd.Flags().StringVar(&restoreProfile, "profile", "balanced", "Resource profile: conservative (--parallel=1, low memory), balanced, aggressive (max performance)")
 	restoreSingleCmd.Flags().BoolVar(&restoreVerbose, "verbose", false, "Show detailed restore progress")
 	restoreSingleCmd.Flags().BoolVar(&restoreNoProgress, "no-progress", false, "Disable progress indicators")
 	restoreSingleCmd.Flags().StringVar(&restoreEncryptionKeyFile, "encryption-key-file", "", "Path to encryption key file (required for encrypted backups)")
 	restoreSingleCmd.Flags().StringVar(&restoreEncryptionKeyEnv, "encryption-key-env", "DBBACKUP_ENCRYPTION_KEY", "Environment variable containing encryption key")
 	restoreSingleCmd.Flags().BoolVar(&restoreDiagnose, "diagnose", false, "Run deep diagnosis before restore to detect corruption/truncation")
 	restoreSingleCmd.Flags().StringVar(&restoreSaveDebugLog, "save-debug-log", "", "Save detailed error report to file on failure (e.g., /tmp/restore-debug.json)")
-	restoreSingleCmd.Flags().BoolVar(&restoreDebugLocks, "debug-locks", false, "Enable detailed lock debugging (captures PostgreSQL config, Guard decisions, boost attempts)")
 
 	// Cluster restore flags
-	restoreClusterCmd.Flags().BoolVar(&restoreListDBs, "list-databases", false, "List databases in cluster backup and exit")
-	restoreClusterCmd.Flags().StringVar(&restoreDatabase, "database", "", "Extract/restore single database from cluster")
-	restoreClusterCmd.Flags().StringVar(&restoreDatabases, "databases", "", "Extract multiple databases (comma-separated)")
-	restoreClusterCmd.Flags().StringVar(&restoreOutputDir, "output-dir", "", "Extract to directory without restoring (requires --database or --databases)")
 	restoreClusterCmd.Flags().BoolVar(&restoreConfirm, "confirm", false, "Confirm and execute restore (required)")
 	restoreClusterCmd.Flags().BoolVar(&restoreDryRun, "dry-run", false, "Show what would be done without executing")
 	restoreClusterCmd.Flags().BoolVar(&restoreForce, "force", false, "Skip safety checks and confirmations")
 	restoreClusterCmd.Flags().BoolVar(&restoreCleanCluster, "clean-cluster", false, "Drop all existing user databases before restore (disaster recovery)")
-	restoreClusterCmd.Flags().StringVar(&restoreProfile, "profile", "conservative", "Resource profile: conservative (single-threaded, prevents lock issues), balanced (auto-detect), aggressive (max speed)")
-	restoreClusterCmd.Flags().IntVar(&restoreJobs, "jobs", 0, "Number of parallel decompression jobs (0 = auto, overrides profile)")
-	restoreClusterCmd.Flags().IntVar(&restoreParallelDBs, "parallel-dbs", 0, "Number of databases to restore in parallel (0 = use profile, 1 = sequential, -1 = auto-detect, overrides profile)")
+	restoreClusterCmd.Flags().IntVar(&restoreJobs, "jobs", 0, "Number of parallel decompression jobs (0 = auto)")
 	restoreClusterCmd.Flags().StringVar(&restoreWorkdir, "workdir", "", "Working directory for extraction (use when system disk is small, e.g. /mnt/storage/restore_tmp)")
 	restoreClusterCmd.Flags().BoolVar(&restoreVerbose, "verbose", false, "Show detailed restore progress")
 	restoreClusterCmd.Flags().BoolVar(&restoreNoProgress, "no-progress", false, "Disable progress indicators")
@@ -347,11 +296,6 @@ func init() {
 	restoreClusterCmd.Flags().StringVar(&restoreEncryptionKeyEnv, "encryption-key-env", "DBBACKUP_ENCRYPTION_KEY", "Environment variable containing encryption key")
 	restoreClusterCmd.Flags().BoolVar(&restoreDiagnose, "diagnose", false, "Run deep diagnosis on all dumps before restore")
 	restoreClusterCmd.Flags().StringVar(&restoreSaveDebugLog, "save-debug-log", "", "Save detailed error report to file on failure (e.g., /tmp/restore-debug.json)")
-	restoreClusterCmd.Flags().BoolVar(&restoreDebugLocks, "debug-locks", false, "Enable detailed lock debugging (captures PostgreSQL config, Guard decisions, boost attempts)")
-	restoreClusterCmd.Flags().BoolVar(&restoreClean, "clean", false, "Drop and recreate target database (for single DB restore)")
-	restoreClusterCmd.Flags().BoolVar(&restoreCreate, "create", false, "Create target database if it doesn't exist (for single DB restore)")
-	restoreClusterCmd.Flags().BoolVar(&restoreOOMProtection, "oom-protection", false, "Enable OOM protection: disable swap, tune PostgreSQL memory, protect from OOM killer")
-	restoreClusterCmd.Flags().BoolVar(&restoreLowMemory, "low-memory", false, "Force low-memory mode: single-threaded restore with minimal memory (use for <8GB RAM or very large backups)")
 
 	// PITR restore flags
 	restorePITRCmd.Flags().StringVar(&pitrBaseBackup, "base-backup", "", "Path to base backup file (.tar.gz) (required)")
@@ -490,16 +434,6 @@ func runRestoreDiagnose(cmd *cobra.Command, args []string) error {
 func runRestoreSingle(cmd *cobra.Command, args []string) error {
 	archivePath := args[0]
 
-	// Apply resource profile
-	if err := config.ApplyProfile(cfg, restoreProfile, restoreJobs, 0); err != nil {
-		log.Warn("Invalid profile, using balanced", "error", err)
-		restoreProfile = "balanced"
-		_ = config.ApplyProfile(cfg, restoreProfile, restoreJobs, 0)
-	}
-	if cfg.Debug && restoreProfile != "balanced" {
-		log.Info("Using restore profile", "profile", restoreProfile)
-	}
-
 	// Check if this is a cloud URI
 	var cleanupFunc func() error
 
@@ -638,12 +572,6 @@ func runRestoreSingle(cmd *cobra.Command, args []string) error {
 		log.Info("Debug logging enabled", "output", restoreSaveDebugLog)
 	}
 
-	// Enable lock debugging if requested (single restore)
-	if restoreDebugLocks {
-		cfg.DebugLocks = true
-		log.Info("🔍 Lock debugging enabled - will capture PostgreSQL lock config, Guard decisions, boost attempts")
-	}
-
 	// Setup signal handling
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
@@ -697,36 +625,14 @@ func runRestoreSingle(cmd *cobra.Command, args []string) error {
 	startTime := time.Now()
 	auditLogger.LogRestoreStart(user, targetDB, archivePath)
 
-	// Notify: restore started
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventRestoreStarted, notify.SeverityInfo, "Database restore started").
-			WithDatabase(targetDB).
-			WithDetail("archive", filepath.Base(archivePath)))
-	}
-
 	if err := engine.RestoreSingle(ctx, archivePath, targetDB, restoreClean, restoreCreate); err != nil {
 		auditLogger.LogRestoreFailed(user, targetDB, err)
-		// Notify: restore failed
-		if notifyManager != nil {
-			notifyManager.Notify(notify.NewEvent(notify.EventRestoreFailed, notify.SeverityError, "Database restore failed").
-				WithDatabase(targetDB).
-				WithError(err).
-				WithDuration(time.Since(startTime)))
-		}
 		return fmt.Errorf("restore failed: %w", err)
 	}
 
 	// Audit log: restore success
 	auditLogger.LogRestoreComplete(user, targetDB, time.Since(startTime))
 
-	// Notify: restore completed
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventRestoreCompleted, notify.SeveritySuccess, "Database restore completed successfully").
-			WithDatabase(targetDB).
-			WithDuration(time.Since(startTime)).
-			WithDetail("archive", filepath.Base(archivePath)))
-	}
-
 	log.Info("[OK] Restore completed successfully", "database", targetDB)
 	return nil
 }
@@ -749,203 +655,6 @@ func runRestoreCluster(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("archive not found: %s", archivePath)
 	}
 
-	// Handle --list-databases flag
-	if restoreListDBs {
-		return runListDatabases(archivePath)
-	}
-
-	// Handle single/multiple database extraction
-	if restoreDatabase != "" || restoreDatabases != "" {
-		return runExtractDatabases(archivePath)
-	}
-
-	// Otherwise proceed with full cluster restore
-	return runFullClusterRestore(archivePath)
-}
-
-// runListDatabases lists all databases in a cluster backup
-func runListDatabases(archivePath string) error {
-	ctx := context.Background()
-
-	log.Info("Scanning cluster backup", "archive", filepath.Base(archivePath))
-	fmt.Println()
-
-	databases, err := restore.ListDatabasesInCluster(ctx, archivePath, log)
-	if err != nil {
-		return fmt.Errorf("failed to list databases: %w", err)
-	}
-
-	fmt.Printf("📦 Databases in cluster backup:\n")
-	var totalSize int64
-	for _, db := range databases {
-		sizeStr := formatSize(db.Size)
-		fmt.Printf("  - %-30s (%s)\n", db.Name, sizeStr)
-		totalSize += db.Size
-	}
-
-	fmt.Printf("\nTotal: %s across %d database(s)\n", formatSize(totalSize), len(databases))
-	return nil
-}
-
-// runExtractDatabases extracts single or multiple databases from cluster backup
-func runExtractDatabases(archivePath string) error {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	// Setup signal handling
-	sigChan := make(chan os.Signal, 1)
-	signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM)
-	defer signal.Stop(sigChan)
-
-	go func() {
-		<-sigChan
-		log.Warn("Extraction interrupted by user")
-		cancel()
-	}()
-
-	// Single database extraction
-	if restoreDatabase != "" {
-		return handleSingleDatabaseExtraction(ctx, archivePath, restoreDatabase)
-	}
-
-	// Multiple database extraction
-	if restoreDatabases != "" {
-		return handleMultipleDatabaseExtraction(ctx, archivePath, restoreDatabases)
-	}
-
-	return nil
-}
-
-// handleSingleDatabaseExtraction handles single database extraction or restore
-func handleSingleDatabaseExtraction(ctx context.Context, archivePath, dbName string) error {
-	// Extract-only mode (no restore)
-	if restoreOutputDir != "" {
-		return extractSingleDatabase(ctx, archivePath, dbName, restoreOutputDir)
-	}
-
-	// Restore mode
-	if !restoreConfirm {
-		fmt.Println("\n[DRY-RUN] DRY-RUN MODE - No changes will be made")
-		fmt.Printf("\nWould extract and restore:\n")
-		fmt.Printf("  Database: %s\n", dbName)
-		fmt.Printf("  From: %s\n", archivePath)
-		targetDB := restoreTarget
-		if targetDB == "" {
-			targetDB = dbName
-		}
-		fmt.Printf("  Target: %s\n", targetDB)
-		if restoreClean {
-			fmt.Printf("  Clean: true (drop and recreate)\n")
-		}
-		if restoreCreate {
-			fmt.Printf("  Create: true (create if missing)\n")
-		}
-		fmt.Println("\nTo execute this restore, add --confirm flag")
-		return nil
-	}
-
-	// Create database instance
-	db, err := database.New(cfg, log)
-	if err != nil {
-		return fmt.Errorf("failed to create database instance: %w", err)
-	}
-	defer db.Close()
-
-	// Create restore engine
-	engine := restore.New(cfg, log, db)
-
-	// Determine target database name
-	targetDB := restoreTarget
-	if targetDB == "" {
-		targetDB = dbName
-	}
-
-	log.Info("Restoring single database from cluster", "database", dbName, "target", targetDB)
-
-	// Restore single database from cluster
-	if err := engine.RestoreSingleFromCluster(ctx, archivePath, dbName, targetDB, restoreClean, restoreCreate); err != nil {
-		return fmt.Errorf("restore failed: %w", err)
-	}
-
-	fmt.Printf("\n✅ Successfully restored '%s' as '%s'\n", dbName, targetDB)
-	return nil
-}
-
-// extractSingleDatabase extracts a single database without restoring
-func extractSingleDatabase(ctx context.Context, archivePath, dbName, outputDir string) error {
-	log.Info("Extracting database", "database", dbName, "output", outputDir)
-
-	// Create progress indicator
-	prog := progress.NewIndicator(!restoreNoProgress, "dots")
-
-	extractedPath, err := restore.ExtractDatabaseFromCluster(ctx, archivePath, dbName, outputDir, log, prog)
-	if err != nil {
-		return fmt.Errorf("extraction failed: %w", err)
-	}
-
-	fmt.Printf("\n✅ Extracted: %s\n", extractedPath)
-	fmt.Printf("   Database: %s\n", dbName)
-	fmt.Printf("   Location: %s\n", outputDir)
-	return nil
-}
-
-// handleMultipleDatabaseExtraction handles multiple database extraction
-func handleMultipleDatabaseExtraction(ctx context.Context, archivePath, databases string) error {
-	if restoreOutputDir == "" {
-		return fmt.Errorf("--output-dir required when using --databases")
-	}
-
-	// Parse database list
-	dbNames := strings.Split(databases, ",")
-	for i := range dbNames {
-		dbNames[i] = strings.TrimSpace(dbNames[i])
-	}
-
-	log.Info("Extracting multiple databases", "count", len(dbNames), "output", restoreOutputDir)
-
-	// Create progress indicator
-	prog := progress.NewIndicator(!restoreNoProgress, "dots")
-
-	extractedPaths, err := restore.ExtractMultipleDatabasesFromCluster(ctx, archivePath, dbNames, restoreOutputDir, log, prog)
-	if err != nil {
-		return fmt.Errorf("extraction failed: %w", err)
-	}
-
-	fmt.Printf("\n✅ Extracted %d database(s):\n", len(extractedPaths))
-	for dbName, path := range extractedPaths {
-		fmt.Printf("   - %s → %s\n", dbName, filepath.Base(path))
-	}
-	fmt.Printf("   Location: %s\n", restoreOutputDir)
-	return nil
-}
-
-// runFullClusterRestore performs a full cluster restore
-func runFullClusterRestore(archivePath string) error {
-
-	// Apply resource profile
-	if err := config.ApplyProfile(cfg, restoreProfile, restoreJobs, restoreParallelDBs); err != nil {
-		log.Warn("Invalid profile, using balanced", "error", err)
-		restoreProfile = "balanced"
-		_ = config.ApplyProfile(cfg, restoreProfile, restoreJobs, restoreParallelDBs)
-	}
-	if cfg.Debug || restoreProfile != "balanced" {
-		log.Info("Using restore profile", "profile", restoreProfile, "parallel_dbs", cfg.ClusterParallelism, "jobs", cfg.Jobs)
-	}
-
-	// Convert to absolute path
-	if !filepath.IsAbs(archivePath) {
-		absPath, err := filepath.Abs(archivePath)
-		if err != nil {
-			return fmt.Errorf("invalid archive path: %w", err)
-		}
-		archivePath = absPath
-	}
-
-	// Check if file exists
-	if _, err := os.Stat(archivePath); err != nil {
-		return fmt.Errorf("archive not found: %s", archivePath)
-	}
-
 	// Check if backup is encrypted and decrypt if necessary
 	if backup.IsBackupEncrypted(archivePath) {
 		log.Info("Encrypted cluster backup detected, decrypting...")
@@ -1074,17 +783,6 @@ func runFullClusterRestore(archivePath string) error {
 		}
 	}
 
-	// Override cluster parallelism if --parallel-dbs is specified
-	if restoreParallelDBs == -1 {
-		// Auto-detect optimal parallelism based on system resources
-		autoParallel := restore.CalculateOptimalParallel()
-		cfg.ClusterParallelism = autoParallel
-		log.Info("Auto-detected optimal parallelism for database restores", "parallel_dbs", autoParallel, "mode", "auto")
-	} else if restoreParallelDBs > 0 {
-		cfg.ClusterParallelism = restoreParallelDBs
-		log.Info("Using custom parallelism for database restores", "parallel_dbs", restoreParallelDBs)
-	}
-
 	// Create restore engine
 	engine := restore.New(cfg, log, db)
 
@@ -1094,12 +792,6 @@ func runFullClusterRestore(archivePath string) error {
 		log.Info("Debug logging enabled", "output", restoreSaveDebugLog)
 	}
 
-	// Enable lock debugging if requested (cluster restore)
-	if restoreDebugLocks {
-		cfg.DebugLocks = true
-		log.Info("🔍 Lock debugging enabled - will capture PostgreSQL lock config, Guard decisions, boost attempts")
-	}
-
 	// Setup signal handling
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
@@ -1135,50 +827,22 @@ func runFullClusterRestore(archivePath string) error {
 		log.Info("Database cleanup completed")
 	}
 
-	// OPTIMIZATION: Pre-extract archive once for both diagnosis and restore
-	// This avoids extracting the same tar.gz twice (saves 5-10 min on large clusters)
-	var extractedDir string
-	var extractErr error
-
-	if restoreDiagnose || restoreConfirm {
-		log.Info("Pre-extracting cluster archive (shared for validation and restore)...")
-		extractedDir, extractErr = safety.ValidateAndExtractCluster(ctx, archivePath)
-		if extractErr != nil {
-			return fmt.Errorf("failed to extract cluster archive: %w", extractErr)
-		}
-		defer os.RemoveAll(extractedDir) // Cleanup at end
-		log.Info("Archive extracted successfully", "location", extractedDir)
-	}
-
-	// Run pre-restore diagnosis if requested (using already-extracted directory)
+	// Run pre-restore diagnosis if requested
 	if restoreDiagnose {
-		log.Info("[DIAG] Running pre-restore diagnosis on extracted dumps...")
+		log.Info("[DIAG] Running pre-restore diagnosis...")
+
+		// Create temp directory for extraction in configured WorkDir
+		workDir := cfg.GetEffectiveWorkDir()
+		diagTempDir, err := os.MkdirTemp(workDir, "dbbackup-diagnose-*")
+		if err != nil {
+			return fmt.Errorf("failed to create temp directory for diagnosis in %s: %w", workDir, err)
+		}
+		defer os.RemoveAll(diagTempDir)
 
 		diagnoser := restore.NewDiagnoser(log, restoreVerbose)
-		// Diagnose dumps directly from extracted directory
-		dumpsDir := filepath.Join(extractedDir, "dumps")
-		if _, err := os.Stat(dumpsDir); err != nil {
-			return fmt.Errorf("no dumps directory found in extracted archive: %w", err)
-		}
-
-		entries, err := os.ReadDir(dumpsDir)
+		results, err := diagnoser.DiagnoseClusterDumps(archivePath, diagTempDir)
 		if err != nil {
-			return fmt.Errorf("failed to read dumps directory: %w", err)
-		}
-
-		// Diagnose each dump file
-		var results []*restore.DiagnoseResult
-		for _, entry := range entries {
-			if entry.IsDir() {
-				continue
-			}
-			dumpPath := filepath.Join(dumpsDir, entry.Name())
-			result, err := diagnoser.DiagnoseFile(dumpPath)
-			if err != nil {
-				log.Warn("Could not diagnose dump", "file", entry.Name(), "error", err)
-				continue
-			}
-			results = append(results, result)
+			return fmt.Errorf("diagnosis failed: %w", err)
 		}
 
 		// Check for any invalid dumps
@@ -1218,36 +882,14 @@ func runFullClusterRestore(archivePath string) error {
 	startTime := time.Now()
 	auditLogger.LogRestoreStart(user, "all_databases", archivePath)
 
-	// Notify: restore started
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventRestoreStarted, notify.SeverityInfo, "Cluster restore started").
-			WithDatabase("all_databases").
-			WithDetail("archive", filepath.Base(archivePath)))
-	}
-
-	// Pass pre-extracted directory to avoid double extraction
-	if err := engine.RestoreCluster(ctx, archivePath, extractedDir); err != nil {
+	if err := engine.RestoreCluster(ctx, archivePath); err != nil {
 		auditLogger.LogRestoreFailed(user, "all_databases", err)
-		// Notify: restore failed
-		if notifyManager != nil {
-			notifyManager.Notify(notify.NewEvent(notify.EventRestoreFailed, notify.SeverityError, "Cluster restore failed").
-				WithDatabase("all_databases").
-				WithError(err).
-				WithDuration(time.Since(startTime)))
-		}
 		return fmt.Errorf("cluster restore failed: %w", err)
 	}
 
 	// Audit log: restore success
 	auditLogger.LogRestoreComplete(user, "all_databases", time.Since(startTime))
 
-	// Notify: restore completed
-	if notifyManager != nil {
-		notifyManager.Notify(notify.NewEvent(notify.EventRestoreCompleted, notify.SeveritySuccess, "Cluster restore completed successfully").
-			WithDatabase("all_databases").
-			WithDuration(time.Since(startTime)))
-	}
-
 	log.Info("[OK] Cluster restore completed successfully")
 	return nil
 }

cmd/restore_preview.go

@@ -1,328 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"github.com/dustin/go-humanize"
-	"github.com/spf13/cobra"
-
-	"dbbackup/internal/restore"
-)
-
-var (
-	previewCompareSchema bool
-	previewEstimate      bool
-)
-
-var restorePreviewCmd = &cobra.Command{
-	Use:   "preview [archive-file]",
-	Short: "Preview backup contents before restoring",
-	Long: `Show detailed information about what a backup contains before actually restoring it.
-
-This command analyzes backup archives and provides:
-  - Database name, version, and size information
-  - Table count and largest tables
-  - Estimated restore time based on system resources
-  - Required disk space
-  - Schema comparison with current database (optional)
-  - Resource recommendations
-
-Use this to:
-  - See what you'll get before committing to a long restore
-  - Estimate restore time and resource requirements
-  - Identify schema changes since backup was created
-  - Verify backup contains expected data
-
-Examples:
-  # Preview a backup
-  dbbackup restore preview mydb.dump.gz
-
-  # Preview with restore time estimation
-  dbbackup restore preview mydb.dump.gz --estimate
-
-  # Preview with schema comparison to current database
-  dbbackup restore preview mydb.dump.gz --compare-schema
-
-  # Preview cluster backup
-  dbbackup restore preview cluster_backup.tar.gz
-`,
-	Args: cobra.ExactArgs(1),
-	RunE: runRestorePreview,
-}
-
-func init() {
-	restoreCmd.AddCommand(restorePreviewCmd)
-
-	restorePreviewCmd.Flags().BoolVar(&previewCompareSchema, "compare-schema", false, "Compare backup schema with current database")
-	restorePreviewCmd.Flags().BoolVar(&previewEstimate, "estimate", true, "Estimate restore time and resource requirements")
-	restorePreviewCmd.Flags().BoolVar(&restoreVerbose, "verbose", false, "Show detailed analysis")
-}
-
-func runRestorePreview(cmd *cobra.Command, args []string) error {
-	archivePath := args[0]
-
-	// Convert to absolute path
-	if !filepath.IsAbs(archivePath) {
-		absPath, err := filepath.Abs(archivePath)
-		if err != nil {
-			return fmt.Errorf("invalid archive path: %w", err)
-		}
-		archivePath = absPath
-	}
-
-	// Check if file exists
-	stat, err := os.Stat(archivePath)
-	if err != nil {
-		return fmt.Errorf("archive not found: %s", archivePath)
-	}
-
-	fmt.Printf("\n%s\n", strings.Repeat("=", 70))
-	fmt.Printf("BACKUP PREVIEW: %s\n", filepath.Base(archivePath))
-	fmt.Printf("%s\n\n", strings.Repeat("=", 70))
-
-	// Get file info
-	fileSize := stat.Size()
-	fmt.Printf("File Information:\n")
-	fmt.Printf("  Path:         %s\n", archivePath)
-	fmt.Printf("  Size:         %s (%d bytes)\n", humanize.Bytes(uint64(fileSize)), fileSize)
-	fmt.Printf("  Modified:     %s\n", stat.ModTime().Format("2006-01-02 15:04:05"))
-	fmt.Printf("  Age:          %s\n", humanize.Time(stat.ModTime()))
-	fmt.Println()
-
-	// Detect format
-	format := restore.DetectArchiveFormat(archivePath)
-	fmt.Printf("Format Detection:\n")
-	fmt.Printf("  Type:         %s\n", format.String())
-
-	if format.IsCompressed() {
-		fmt.Printf("  Compressed:   Yes\n")
-	} else {
-		fmt.Printf("  Compressed:   No\n")
-	}
-	fmt.Println()
-
-	// Run diagnosis
-	diagnoser := restore.NewDiagnoser(log, restoreVerbose)
-	result, err := diagnoser.DiagnoseFile(archivePath)
-	if err != nil {
-		return fmt.Errorf("failed to analyze backup: %w", err)
-	}
-
-	// Database information
-	fmt.Printf("Database Information:\n")
-
-	if format.IsClusterBackup() {
-		// For cluster backups, extract database list
-		fmt.Printf("  Type:         Cluster Backup (multiple databases)\n")
-
-		// Try to list databases
-		if dbList, err := listDatabasesInCluster(archivePath); err == nil && len(dbList) > 0 {
-			fmt.Printf("  Databases:    %d\n", len(dbList))
-			fmt.Printf("\n  Database List:\n")
-			for _, db := range dbList {
-				fmt.Printf("    - %s\n", db)
-			}
-		} else {
-			fmt.Printf("  Databases:    Multiple (use --list-databases to see all)\n")
-		}
-	} else {
-		// Single database backup
-		dbName := extractDatabaseName(archivePath, result)
-		fmt.Printf("  Database:     %s\n", dbName)
-
-		if result.Details != nil && result.Details.TableCount > 0 {
-			fmt.Printf("  Tables:       %d\n", result.Details.TableCount)
-
-			if len(result.Details.TableList) > 0 {
-				fmt.Printf("\n  Largest Tables (top 5):\n")
-				displayCount := 5
-				if len(result.Details.TableList) < displayCount {
-					displayCount = len(result.Details.TableList)
-				}
-				for i := 0; i < displayCount; i++ {
-					fmt.Printf("    - %s\n", result.Details.TableList[i])
-				}
-				if len(result.Details.TableList) > 5 {
-					fmt.Printf("    ... and %d more\n", len(result.Details.TableList)-5)
-				}
-			}
-		}
-	}
-	fmt.Println()
-
-	// Size estimation
-	if result.Details != nil && result.Details.ExpandedSize > 0 {
-		fmt.Printf("Size Estimates:\n")
-		fmt.Printf("  Compressed:   %s\n", humanize.Bytes(uint64(fileSize)))
-		fmt.Printf("  Uncompressed: %s\n", humanize.Bytes(uint64(result.Details.ExpandedSize)))
-
-		if result.Details.CompressionRatio > 0 {
-			fmt.Printf("  Ratio:        %.1f%% (%.2fx compression)\n",
-				result.Details.CompressionRatio*100,
-				float64(result.Details.ExpandedSize)/float64(fileSize))
-		}
-
-		// Estimate disk space needed (uncompressed + indexes + temp space)
-		estimatedDisk := int64(float64(result.Details.ExpandedSize) * 1.5) // 1.5x for indexes and temp
-		fmt.Printf("  Disk needed:  %s (including indexes and temporary space)\n",
-			humanize.Bytes(uint64(estimatedDisk)))
-		fmt.Println()
-	}
-
-	// Restore time estimation
-	if previewEstimate {
-		fmt.Printf("Restore Estimates:\n")
-
-		// Apply current profile
-		profile := cfg.GetCurrentProfile()
-		if profile != nil {
-			fmt.Printf("  Profile:      %s (P:%d J:%d)\n",
-				profile.Name, profile.ClusterParallelism, profile.Jobs)
-		}
-
-		// Estimate extraction time
-		extractionSpeed := int64(500 * 1024 * 1024) // 500 MB/s typical
-		extractionTime := time.Duration(fileSize/extractionSpeed) * time.Second
-
-		fmt.Printf("  Extract time: ~%s\n", formatDuration(extractionTime))
-
-		// Estimate restore time (depends on data size and parallelism)
-		if result.Details != nil && result.Details.ExpandedSize > 0 {
-			// Rough estimate: 50MB/s per job for PostgreSQL restore
-			restoreSpeed := int64(50 * 1024 * 1024)
-			if profile != nil {
-				restoreSpeed *= int64(profile.Jobs)
-			}
-			restoreTime := time.Duration(result.Details.ExpandedSize/restoreSpeed) * time.Second
-
-			fmt.Printf("  Restore time: ~%s\n", formatDuration(restoreTime))
-
-			// Validation time (10% of restore)
-			validationTime := restoreTime / 10
-			fmt.Printf("  Validation:   ~%s\n", formatDuration(validationTime))
-
-			// Total
-			totalTime := extractionTime + restoreTime + validationTime
-			fmt.Printf("  Total (RTO):  ~%s\n", formatDuration(totalTime))
-		}
-
-		fmt.Println()
-	}
-
-	// Validation status
-	fmt.Printf("Validation Status:\n")
-	if result.IsValid {
-		fmt.Printf("  Status:       ✓ VALID - Backup appears intact\n")
-	} else {
-		fmt.Printf("  Status:       ✗ INVALID - Backup has issues\n")
-	}
-
-	if result.IsTruncated {
-		fmt.Printf("  Truncation:   ✗ File appears truncated\n")
-	}
-	if result.IsCorrupted {
-		fmt.Printf("  Corruption:   ✗ Corruption detected\n")
-	}
-
-	if len(result.Errors) > 0 {
-		fmt.Printf("\n  Errors:\n")
-		for _, err := range result.Errors {
-			fmt.Printf("    - %s\n", err)
-		}
-	}
-
-	if len(result.Warnings) > 0 {
-		fmt.Printf("\n  Warnings:\n")
-		for _, warn := range result.Warnings {
-			fmt.Printf("    - %s\n", warn)
-		}
-	}
-	fmt.Println()
-
-	// Schema comparison
-	if previewCompareSchema {
-		fmt.Printf("Schema Comparison:\n")
-		fmt.Printf("  Status:       Not yet implemented\n")
-		fmt.Printf("                (Compare with current database schema)\n")
-		fmt.Println()
-	}
-
-	// Recommendations
-	fmt.Printf("Recommendations:\n")
-
-	if !result.IsValid {
-		fmt.Printf("  - ✗ DO NOT restore this backup - validation failed\n")
-		fmt.Printf("  - Run 'dbbackup restore diagnose %s' for detailed analysis\n", filepath.Base(archivePath))
-	} else {
-		fmt.Printf("  - ✓ Backup is valid and ready to restore\n")
-
-		// Resource recommendations
-		if result.Details != nil && result.Details.ExpandedSize > 0 {
-			estimatedRAM := result.Details.ExpandedSize / (1024 * 1024 * 1024) / 10 // Rough: 10% of data size
-			if estimatedRAM < 4 {
-				estimatedRAM = 4
-			}
-			fmt.Printf("  - Recommended RAM: %dGB or more\n", estimatedRAM)
-
-			// Disk space
-			estimatedDisk := int64(float64(result.Details.ExpandedSize) * 1.5)
-			fmt.Printf("  - Ensure %s free disk space\n", humanize.Bytes(uint64(estimatedDisk)))
-		}
-
-		// Profile recommendation
-		if result.Details != nil && result.Details.TableCount > 100 {
-			fmt.Printf("  - Use 'conservative' profile for databases with many tables\n")
-		} else {
-			fmt.Printf("  - Use 'turbo' profile for fastest restore\n")
-		}
-	}
-
-	fmt.Printf("\n%s\n", strings.Repeat("=", 70))
-
-	if result.IsValid {
-		fmt.Printf("Ready to restore? Run:\n")
-		if format.IsClusterBackup() {
-			fmt.Printf("  dbbackup restore cluster %s --confirm\n", filepath.Base(archivePath))
-		} else {
-			fmt.Printf("  dbbackup restore single %s --confirm\n", filepath.Base(archivePath))
-		}
-	} else {
-		fmt.Printf("Fix validation errors before attempting restore.\n")
-	}
-	fmt.Printf("%s\n\n", strings.Repeat("=", 70))
-
-	if !result.IsValid {
-		return fmt.Errorf("backup validation failed")
-	}
-
-	return nil
-}
-
-// Helper functions
-
-func extractDatabaseName(archivePath string, result *restore.DiagnoseResult) string {
-	// Try to extract from filename
-	baseName := filepath.Base(archivePath)
-	baseName = strings.TrimSuffix(baseName, ".gz")
-	baseName = strings.TrimSuffix(baseName, ".dump")
-	baseName = strings.TrimSuffix(baseName, ".sql")
-	baseName = strings.TrimSuffix(baseName, ".tar")
-
-	// Remove timestamp patterns
-	parts := strings.Split(baseName, "_")
-	if len(parts) > 0 {
-		return parts[0]
-	}
-
-	return "unknown"
-}
-
-func listDatabasesInCluster(archivePath string) ([]string, error) {
-	// This would extract and list databases from tar.gz
-	// For now, return empty to indicate it needs implementation
-	return nil, fmt.Errorf("not implemented")
-}

cmd/root.go

@@ -3,11 +3,9 @@ package cmd
 import (
 	"context"
 	"fmt"
-	"strings"
 
 	"dbbackup/internal/config"
 	"dbbackup/internal/logger"
-	"dbbackup/internal/notify"
 	"dbbackup/internal/security"
 
 	"github.com/spf13/cobra"
@@ -15,11 +13,10 @@ import (
 )
 
 var (
-	cfg           *config.Config
-	log           logger.Logger
-	auditLogger   *security.AuditLogger
-	rateLimiter   *security.RateLimiter
-	notifyManager *notify.Manager
+	cfg         *config.Config
+	log         logger.Logger
+	auditLogger *security.AuditLogger
+	rateLimiter *security.RateLimiter
 )
 
 // rootCmd represents the base command when called without any subcommands
@@ -55,26 +52,9 @@ For help with specific commands, use: dbbackup [command] --help`,
 
 		// Load local config if not disabled
 		if !cfg.NoLoadConfig {
-			// Use custom config path if specified, otherwise default to current directory
-			var localCfg *config.LocalConfig
-			var err error
-			if cfg.ConfigPath != "" {
-				localCfg, err = config.LoadLocalConfigFromPath(cfg.ConfigPath)
-				if err != nil {
-					log.Warn("Failed to load config from specified path", "path", cfg.ConfigPath, "error", err)
-				} else if localCfg != nil {
-					log.Info("Loaded configuration", "path", cfg.ConfigPath)
-				}
-			} else {
-				localCfg, err = config.LoadLocalConfig()
-				if err != nil {
-					log.Warn("Failed to load local config", "error", err)
-				} else if localCfg != nil {
-					log.Info("Loaded configuration from .dbbackup.conf")
-				}
-			}
-
-			if localCfg != nil {
+			if localCfg, err := config.LoadLocalConfig(); err != nil {
+				log.Warn("Failed to load local config", "error", err)
+			} else if localCfg != nil {
 				// Save current flag values that were explicitly set
 				savedBackupDir := cfg.BackupDir
 				savedHost := cfg.Host
@@ -89,6 +69,7 @@ For help with specific commands, use: dbbackup [command] --help`,
 
 				// Apply config from file
 				config.ApplyLocalConfig(cfg, localCfg)
+				log.Info("Loaded configuration from .dbbackup.conf")
 
 				// Restore explicitly set flag values (flags have priority)
 				if flagsSet["backup-dir"] {
@@ -124,12 +105,6 @@ For help with specific commands, use: dbbackup [command] --help`,
 			}
 		}
 
-		// Auto-detect socket from --host path (if host starts with /)
-		if strings.HasPrefix(cfg.Host, "/") && cfg.Socket == "" {
-			cfg.Socket = cfg.Host
-			cfg.Host = "localhost" // Reset host for socket connections
-		}
-
 		return cfg.SetDatabaseType(cfg.DatabaseType)
 	},
 }
@@ -145,22 +120,13 @@ func Execute(ctx context.Context, config *config.Config, logger logger.Logger) e
 	// Initialize rate limiter
 	rateLimiter = security.NewRateLimiter(config.MaxRetries, logger)
 
-	// Initialize notification manager from environment variables
-	notifyCfg := notify.ConfigFromEnv()
-	notifyManager = notify.NewManager(notifyCfg)
-	if notifyManager.HasEnabledNotifiers() {
-		logger.Info("Notifications enabled", "smtp", notifyCfg.SMTPEnabled, "webhook", notifyCfg.WebhookEnabled)
-	}
-
 	// Set version info
 	rootCmd.Version = fmt.Sprintf("%s (built: %s, commit: %s)",
 		cfg.Version, cfg.BuildTime, cfg.GitCommit)
 
 	// Add persistent flags
-	rootCmd.PersistentFlags().StringVarP(&cfg.ConfigPath, "config", "c", "", "Path to config file (default: .dbbackup.conf in current directory)")
 	rootCmd.PersistentFlags().StringVar(&cfg.Host, "host", cfg.Host, "Database host")
 	rootCmd.PersistentFlags().IntVar(&cfg.Port, "port", cfg.Port, "Database port")
-	rootCmd.PersistentFlags().StringVar(&cfg.Socket, "socket", cfg.Socket, "Unix socket path for MySQL/MariaDB (e.g., /var/run/mysqld/mysqld.sock)")
 	rootCmd.PersistentFlags().StringVar(&cfg.User, "user", cfg.User, "Database user")
 	rootCmd.PersistentFlags().StringVar(&cfg.Database, "database", cfg.Database, "Database name")
 	rootCmd.PersistentFlags().StringVar(&cfg.Password, "password", cfg.Password, "Database password")
@@ -168,7 +134,6 @@ func Execute(ctx context.Context, config *config.Config, logger logger.Logger) e
 	rootCmd.PersistentFlags().StringVar(&cfg.BackupDir, "backup-dir", cfg.BackupDir, "Backup directory")
 	rootCmd.PersistentFlags().BoolVar(&cfg.NoColor, "no-color", cfg.NoColor, "Disable colored output")
 	rootCmd.PersistentFlags().BoolVar(&cfg.Debug, "debug", cfg.Debug, "Enable debug logging")
-	rootCmd.PersistentFlags().BoolVar(&cfg.DebugLocks, "debug-locks", cfg.DebugLocks, "Enable detailed lock debugging (captures PostgreSQL lock configuration, Large DB Guard decisions, boost attempts)")
 	rootCmd.PersistentFlags().IntVar(&cfg.Jobs, "jobs", cfg.Jobs, "Number of parallel jobs")
 	rootCmd.PersistentFlags().IntVar(&cfg.DumpJobs, "dump-jobs", cfg.DumpJobs, "Number of parallel dump jobs")
 	rootCmd.PersistentFlags().IntVar(&cfg.MaxCores, "max-cores", cfg.MaxCores, "Maximum CPU cores to use")

cmd/verify_locks.go

@@ -1,64 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"os"
-
-	"dbbackup/internal/checks"
-
-	"github.com/spf13/cobra"
-)
-
-var verifyLocksCmd = &cobra.Command{
-	Use:   "verify-locks",
-	Short: "Check PostgreSQL lock settings and print restore guidance",
-	Long:  `Probe PostgreSQL for lock-related GUCs (max_locks_per_transaction, max_connections, max_prepared_transactions) and print capacity + recommended restore options.`,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		return runVerifyLocks(cmd.Context())
-	},
-}
-
-func runVerifyLocks(ctx context.Context) error {
-	p := checks.NewPreflightChecker(cfg, log)
-	res, err := p.RunAllChecks(ctx, cfg.Database)
-	if err != nil {
-		return err
-	}
-
-	// Find the Postgres lock check in the preflight results
-	var chk checks.PreflightCheck
-	found := false
-	for _, c := range res.Checks {
-		if c.Name == "PostgreSQL lock configuration" {
-			chk = c
-			found = true
-			break
-		}
-	}
-	if !found {
-		fmt.Println("No PostgreSQL lock check available (skipped)")
-		return nil
-	}
-
-	fmt.Printf("%s\n", chk.Name)
-	fmt.Printf("Status: %s\n", chk.Status.String())
-	fmt.Printf("%s\n\n", chk.Message)
-	if chk.Details != "" {
-		fmt.Println(chk.Details)
-	}
-
-	// exit non-zero for failures so scripts can react
-	if chk.Status == checks.StatusFailed {
-		os.Exit(2)
-	}
-	if chk.Status == checks.StatusWarning {
-		os.Exit(0)
-	}
-
-	return nil
-}
-
-func init() {
-	rootCmd.AddCommand(verifyLocksCmd)
-}

cmd/verify_restore.go

@@ -1,371 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"strings"
-	"time"
-
-	"dbbackup/internal/logger"
-	"dbbackup/internal/verification"
-
-	"github.com/spf13/cobra"
-)
-
-var verifyRestoreCmd = &cobra.Command{
-	Use:   "verify-restore",
-	Short: "Systematic verification for large database restores",
-	Long: `Comprehensive verification tool for large database restores with BLOB support.
-
-This tool performs systematic checks to ensure 100% data integrity after restore:
-- Table counts and row counts verification
-- BLOB/Large Object integrity (PostgreSQL large objects, bytea columns)
-- Table checksums (for non-BLOB tables)
-- Database-specific integrity checks
-- Orphaned object detection
-- Index validity checks
-
-Designed to work with VERY LARGE databases and BLOBs with 100% reliability.
-
-Examples:
-  # Verify a restored PostgreSQL database
-  dbbackup verify-restore --engine postgres --database mydb
-
-  # Verify with connection details
-  dbbackup verify-restore --engine postgres --host localhost --port 5432 \
-    --user postgres --password secret --database mydb
-
-  # Verify a MySQL database
-  dbbackup verify-restore --engine mysql --database mydb
-
-  # Verify and output JSON report
-  dbbackup verify-restore --engine postgres --database mydb --json
-
-  # Compare source and restored database
-  dbbackup verify-restore --engine postgres --database source_db --compare restored_db
-
-  # Verify a backup file before restore
-  dbbackup verify-restore --backup-file /backups/mydb.dump
-
-  # Verify multiple databases in parallel
-  dbbackup verify-restore --engine postgres --databases "db1,db2,db3" --parallel 4`,
-	RunE: runVerifyRestore,
-}
-
-var (
-	verifyEngine     string
-	verifyHost       string
-	verifyPort       int
-	verifyUser       string
-	verifyPassword   string
-	verifyDatabase   string
-	verifyDatabases  string
-	verifyCompareDB  string
-	verifyBackupFile string
-	verifyJSON       bool
-	verifyParallel   int
-)
-
-func init() {
-	rootCmd.AddCommand(verifyRestoreCmd)
-
-	verifyRestoreCmd.Flags().StringVar(&verifyEngine, "engine", "postgres", "Database engine (postgres, mysql)")
-	verifyRestoreCmd.Flags().StringVar(&verifyHost, "host", "localhost", "Database host")
-	verifyRestoreCmd.Flags().IntVar(&verifyPort, "port", 5432, "Database port")
-	verifyRestoreCmd.Flags().StringVar(&verifyUser, "user", "", "Database user")
-	verifyRestoreCmd.Flags().StringVar(&verifyPassword, "password", "", "Database password")
-	verifyRestoreCmd.Flags().StringVar(&verifyDatabase, "database", "", "Database to verify")
-	verifyRestoreCmd.Flags().StringVar(&verifyDatabases, "databases", "", "Comma-separated list of databases to verify")
-	verifyRestoreCmd.Flags().StringVar(&verifyCompareDB, "compare", "", "Compare with another database (source vs restored)")
-	verifyRestoreCmd.Flags().StringVar(&verifyBackupFile, "backup-file", "", "Verify backup file integrity before restore")
-	verifyRestoreCmd.Flags().BoolVar(&verifyJSON, "json", false, "Output results as JSON")
-	verifyRestoreCmd.Flags().IntVar(&verifyParallel, "parallel", 1, "Number of parallel verification workers")
-}
-
-func runVerifyRestore(cmd *cobra.Command, args []string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), 24*time.Hour) // Long timeout for large DBs
-	defer cancel()
-
-	log := logger.New("INFO", "text")
-
-	// Get credentials from environment if not provided
-	if verifyUser == "" {
-		verifyUser = os.Getenv("PGUSER")
-		if verifyUser == "" {
-			verifyUser = os.Getenv("MYSQL_USER")
-		}
-		if verifyUser == "" {
-			verifyUser = "postgres"
-		}
-	}
-
-	if verifyPassword == "" {
-		verifyPassword = os.Getenv("PGPASSWORD")
-		if verifyPassword == "" {
-			verifyPassword = os.Getenv("MYSQL_PASSWORD")
-		}
-	}
-
-	// Set default port based on engine
-	if verifyPort == 5432 && (verifyEngine == "mysql" || verifyEngine == "mariadb") {
-		verifyPort = 3306
-	}
-
-	checker := verification.NewLargeRestoreChecker(log, verifyEngine, verifyHost, verifyPort, verifyUser, verifyPassword)
-
-	// Mode 1: Verify backup file
-	if verifyBackupFile != "" {
-		return verifyBackupFileMode(ctx, checker)
-	}
-
-	// Mode 2: Compare two databases
-	if verifyCompareDB != "" {
-		return verifyCompareMode(ctx, checker)
-	}
-
-	// Mode 3: Verify multiple databases in parallel
-	if verifyDatabases != "" {
-		return verifyMultipleDatabases(ctx, log)
-	}
-
-	// Mode 4: Verify single database
-	if verifyDatabase == "" {
-		return fmt.Errorf("--database is required")
-	}
-
-	return verifySingleDatabase(ctx, checker)
-}
-
-func verifyBackupFileMode(ctx context.Context, checker *verification.LargeRestoreChecker) error {
-	fmt.Println()
-	fmt.Println("╔══════════════════════════════════════════════════════════════╗")
-	fmt.Println("║       🔍 BACKUP FILE VERIFICATION                            ║")
-	fmt.Println("╚══════════════════════════════════════════════════════════════╝")
-	fmt.Println()
-
-	result, err := checker.VerifyBackupFile(ctx, verifyBackupFile)
-	if err != nil {
-		return fmt.Errorf("verification failed: %w", err)
-	}
-
-	if verifyJSON {
-		return outputJSON(result, "")
-	}
-
-	fmt.Printf("  File:           %s\n", result.Path)
-	fmt.Printf("  Size:           %s\n", formatBytes(result.SizeBytes))
-	fmt.Printf("  Format:         %s\n", result.Format)
-	fmt.Printf("  Checksum:       %s\n", result.Checksum)
-
-	if result.TableCount > 0 {
-		fmt.Printf("  Tables:         %d\n", result.TableCount)
-	}
-	if result.LargeObjectCount > 0 {
-		fmt.Printf("  Large Objects:  %d\n", result.LargeObjectCount)
-	}
-
-	fmt.Println()
-
-	if result.Valid {
-		fmt.Println("  ✅ Backup file verification PASSED")
-	} else {
-		fmt.Printf("  ❌ Backup file verification FAILED: %s\n", result.Error)
-		return fmt.Errorf("verification failed")
-	}
-
-	if len(result.Warnings) > 0 {
-		fmt.Println()
-		fmt.Println("  Warnings:")
-		for _, w := range result.Warnings {
-			fmt.Printf("    ⚠️  %s\n", w)
-		}
-	}
-
-	fmt.Println()
-	return nil
-}
-
-func verifyCompareMode(ctx context.Context, checker *verification.LargeRestoreChecker) error {
-	if verifyDatabase == "" {
-		return fmt.Errorf("--database (source) is required for comparison")
-	}
-
-	fmt.Println()
-	fmt.Println("╔══════════════════════════════════════════════════════════════╗")
-	fmt.Println("║       🔍 DATABASE COMPARISON                                 ║")
-	fmt.Println("╚══════════════════════════════════════════════════════════════╝")
-	fmt.Println()
-	fmt.Printf("  Source:  %s\n", verifyDatabase)
-	fmt.Printf("  Target:  %s\n", verifyCompareDB)
-	fmt.Println()
-
-	result, err := checker.CompareSourceTarget(ctx, verifyDatabase, verifyCompareDB)
-	if err != nil {
-		return fmt.Errorf("comparison failed: %w", err)
-	}
-
-	if verifyJSON {
-		return outputJSON(result, "")
-	}
-
-	if result.Match {
-		fmt.Println("  ✅ Databases MATCH - restore verified successfully")
-	} else {
-		fmt.Println("  ❌ Databases DO NOT MATCH")
-		fmt.Println()
-		fmt.Println("  Differences:")
-		for _, d := range result.Differences {
-			fmt.Printf("    • %s\n", d)
-		}
-	}
-
-	fmt.Println()
-	return nil
-}
-
-func verifyMultipleDatabases(ctx context.Context, log logger.Logger) error {
-	databases := splitDatabases(verifyDatabases)
-	if len(databases) == 0 {
-		return fmt.Errorf("no databases specified")
-	}
-
-	fmt.Println()
-	fmt.Println("╔══════════════════════════════════════════════════════════════╗")
-	fmt.Println("║       🔍 PARALLEL DATABASE VERIFICATION                      ║")
-	fmt.Println("╚══════════════════════════════════════════════════════════════╝")
-	fmt.Println()
-	fmt.Printf("  Databases: %d\n", len(databases))
-	fmt.Printf("  Workers:   %d\n", verifyParallel)
-	fmt.Println()
-
-	results, err := verification.ParallelVerify(ctx, log, verifyEngine, verifyHost, verifyPort, verifyUser, verifyPassword, databases, verifyParallel)
-	if err != nil {
-		return fmt.Errorf("parallel verification failed: %w", err)
-	}
-
-	if verifyJSON {
-		return outputJSON(results, "")
-	}
-
-	allValid := true
-	for _, r := range results {
-		if r == nil {
-			continue
-		}
-		status := "✅"
-		if !r.Valid {
-			status = "❌"
-			allValid = false
-		}
-		fmt.Printf("  %s %s: %d tables, %d rows, %d BLOBs (%s)\n",
-			status, r.Database, r.TotalTables, r.TotalRows, r.TotalBlobCount, r.Duration.Round(time.Millisecond))
-	}
-
-	fmt.Println()
-	if allValid {
-		fmt.Println("  ✅ All databases verified successfully")
-	} else {
-		fmt.Println("  ❌ Some databases failed verification")
-		return fmt.Errorf("verification failed")
-	}
-
-	fmt.Println()
-	return nil
-}
-
-func verifySingleDatabase(ctx context.Context, checker *verification.LargeRestoreChecker) error {
-	fmt.Println()
-	fmt.Println("╔══════════════════════════════════════════════════════════════╗")
-	fmt.Println("║       🔍 SYSTEMATIC RESTORE VERIFICATION                     ║")
-	fmt.Println("║          For Large Databases & BLOBs                         ║")
-	fmt.Println("╚══════════════════════════════════════════════════════════════╝")
-	fmt.Println()
-	fmt.Printf("  Database: %s\n", verifyDatabase)
-	fmt.Printf("  Engine:   %s\n", verifyEngine)
-	fmt.Printf("  Host:     %s:%d\n", verifyHost, verifyPort)
-	fmt.Println()
-
-	result, err := checker.CheckDatabase(ctx, verifyDatabase)
-	if err != nil {
-		return fmt.Errorf("verification failed: %w", err)
-	}
-
-	if verifyJSON {
-		return outputJSON(result, "")
-	}
-
-	// Summary
-	fmt.Println("  ═══════════════════════════════════════════════════════════")
-	fmt.Println("  VERIFICATION SUMMARY")
-	fmt.Println("  ═══════════════════════════════════════════════════════════")
-	fmt.Println()
-	fmt.Printf("  Tables:         %d\n", result.TotalTables)
-	fmt.Printf("  Total Rows:     %d\n", result.TotalRows)
-	fmt.Printf("  Large Objects:  %d\n", result.TotalBlobCount)
-	fmt.Printf("  BLOB Size:      %s\n", formatBytes(result.TotalBlobBytes))
-	fmt.Printf("  Duration:       %s\n", result.Duration.Round(time.Millisecond))
-	fmt.Println()
-
-	// Table details
-	if len(result.TableChecks) > 0 && len(result.TableChecks) <= 50 {
-		fmt.Println("  Tables:")
-		for _, t := range result.TableChecks {
-			blobIndicator := ""
-			if t.HasBlobColumn {
-				blobIndicator = " [BLOB]"
-			}
-			status := "✓"
-			if !t.Valid {
-				status = "✗"
-			}
-			fmt.Printf("    %s %s.%s: %d rows%s\n", status, t.Schema, t.TableName, t.RowCount, blobIndicator)
-		}
-		fmt.Println()
-	}
-
-	// Integrity errors
-	if len(result.IntegrityErrors) > 0 {
-		fmt.Println("  ❌ INTEGRITY ERRORS:")
-		for _, e := range result.IntegrityErrors {
-			fmt.Printf("    • %s\n", e)
-		}
-		fmt.Println()
-	}
-
-	// Warnings
-	if len(result.Warnings) > 0 {
-		fmt.Println("  ⚠️  WARNINGS:")
-		for _, w := range result.Warnings {
-			fmt.Printf("    • %s\n", w)
-		}
-		fmt.Println()
-	}
-
-	// Final verdict
-	fmt.Println("  ═══════════════════════════════════════════════════════════")
-	if result.Valid {
-		fmt.Println("  ✅ RESTORE VERIFICATION PASSED - Data integrity confirmed")
-	} else {
-		fmt.Println("  ❌ RESTORE VERIFICATION FAILED - See errors above")
-		return fmt.Errorf("verification failed")
-	}
-	fmt.Println("  ═══════════════════════════════════════════════════════════")
-	fmt.Println()
-
-	return nil
-}
-
-func splitDatabases(s string) []string {
-	if s == "" {
-		return nil
-	}
-	var dbs []string
-	for _, db := range strings.Split(s, ",") {
-		db = strings.TrimSpace(db)
-		if db != "" {
-			dbs = append(dbs, db)
-		}
-	}
-	return dbs
-}

deploy/README.md

@@ -1,62 +0,0 @@
-# Deployment Examples for dbbackup
-
-Enterprise deployment configurations for various platforms and orchestration tools.
-
-## Directory Structure
-
-```
-deploy/
-├── README.md
-├── ansible/              # Ansible roles and playbooks
-│   ├── basic.yml         # Simple installation
-│   ├── with-exporter.yml # With Prometheus metrics
-│   ├── with-notifications.yml # With email/Slack alerts
-│   └── enterprise.yml    # Full enterprise setup
-├── kubernetes/           # Kubernetes manifests
-│   ├── cronjob.yaml      # Scheduled backup CronJob
-│   ├── configmap.yaml    # Configuration
-│   └── helm/             # Helm chart
-├── terraform/            # Infrastructure as Code
-│   ├── aws/              # AWS deployment
-│   └── gcp/              # GCP deployment
-└── scripts/              # Helper scripts
-    ├── backup-rotation.sh
-    └── health-check.sh
-```
-
-## Quick Start by Platform
-
-### Ansible
-```bash
-cd ansible
-cp inventory.example inventory
-ansible-playbook -i inventory enterprise.yml
-```
-
-### Kubernetes
-```bash
-kubectl apply -f kubernetes/
-# or with Helm
-helm install dbbackup kubernetes/helm/dbbackup
-```
-
-### Terraform (AWS)
-```bash
-cd terraform/aws
-terraform init
-terraform apply
-```
-
-## Feature Matrix
-
-| Feature | basic | with-exporter | with-notifications | enterprise |
-|---------|:-----:|:-------------:|:------------------:|:----------:|
-| Scheduled Backups | ✓ | ✓ | ✓ | ✓ |
-| Retention Policy | ✓ | ✓ | ✓ | ✓ |
-| GFS Rotation | | | | ✓ |
-| Prometheus Metrics | | ✓ | | ✓ |
-| Email Notifications | | | ✓ | ✓ |
-| Slack/Webhook | | | ✓ | ✓ |
-| Encryption | | | | ✓ |
-| Cloud Upload | | | | ✓ |
-| Catalog Sync | | | | ✓ |

deploy/ansible/README.md

@@ -1,75 +0,0 @@
-# Ansible Deployment for dbbackup
-
-Ansible roles and playbooks for deploying dbbackup in enterprise environments.
-
-## Playbooks
-
-| Playbook | Description |
-|----------|-------------|
-| `basic.yml` | Simple installation without monitoring |
-| `with-exporter.yml` | Installation with Prometheus metrics exporter |
-| `with-notifications.yml` | Installation with SMTP/webhook notifications |
-| `enterprise.yml` | Full enterprise setup (exporter + notifications + GFS retention) |
-
-## Quick Start
-
-```bash
-# Edit inventory
-cp inventory.example inventory
-vim inventory
-
-# Edit variables
-vim group_vars/all.yml
-
-# Deploy basic setup
-ansible-playbook -i inventory basic.yml
-
-# Deploy enterprise setup
-ansible-playbook -i inventory enterprise.yml
-```
-
-## Variables
-
-See `group_vars/all.yml` for all configurable options.
-
-### Required Variables
-
-| Variable | Description | Example |
-|----------|-------------|---------|
-| `dbbackup_version` | Version to install | `3.42.74` |
-| `dbbackup_db_type` | Database type | `postgres` or `mysql` |
-| `dbbackup_backup_dir` | Backup storage path | `/var/backups/databases` |
-
-### Optional Variables
-
-| Variable | Description | Default |
-|----------|-------------|---------|
-| `dbbackup_schedule` | Backup schedule | `daily` |
-| `dbbackup_compression` | Compression level | `6` |
-| `dbbackup_retention_days` | Retention period | `30` |
-| `dbbackup_min_backups` | Minimum backups to keep | `5` |
-| `dbbackup_exporter_port` | Prometheus exporter port | `9399` |
-
-## Directory Structure
-
-```
-ansible/
-├── README.md
-├── inventory.example
-├── group_vars/
-│   └── all.yml
-├── roles/
-│   └── dbbackup/
-│       ├── tasks/
-│       │   └── main.yml
-│       ├── templates/
-│       │   ├── dbbackup.conf.j2
-│       │   ├── env.j2
-│       │   └── systemd-override.conf.j2
-│       └── handlers/
-│           └── main.yml
-├── basic.yml
-├── with-exporter.yml
-├── with-notifications.yml
-└── enterprise.yml
-```

deploy/ansible/basic.yml

@@ -1,42 +0,0 @@
----
-# dbbackup Basic Deployment
-# Simple installation without monitoring or notifications
-#
-# Usage:
-#   ansible-playbook -i inventory basic.yml
-#
-# Features:
-#   ✓ Automated daily backups
-#   ✓ Retention policy (30 days default)
-#   ✗ No Prometheus exporter
-#   ✗ No notifications
-
-- name: Deploy dbbackup (basic)
-  hosts: db_servers
-  become: yes
-  
-  vars:
-    dbbackup_exporter_enabled: false
-    dbbackup_notify_enabled: false
-  
-  roles:
-    - dbbackup
-
-  post_tasks:
-    - name: Verify installation
-      command: "{{ dbbackup_install_dir }}/dbbackup --version"
-      register: version_check
-      changed_when: false
-
-    - name: Display version
-      debug:
-        msg: "Installed: {{ version_check.stdout }}"
-
-    - name: Show timer status
-      command: systemctl status dbbackup-{{ dbbackup_backup_type }}.timer --no-pager
-      register: timer_status
-      changed_when: false
-
-    - name: Display next backup time
-      debug:
-        msg: "{{ timer_status.stdout_lines | select('search', 'Trigger') | list }}"

deploy/ansible/enterprise.yml

@@ -1,153 +0,0 @@
----
-# dbbackup Enterprise Deployment
-# Full-featured installation with all enterprise capabilities
-#
-# Usage:
-#   ansible-playbook -i inventory enterprise.yml
-#
-# Features:
-#   ✓ Automated scheduled backups
-#   ✓ GFS retention policy (Grandfather-Father-Son)
-#   ✓ Prometheus metrics exporter
-#   ✓ SMTP email notifications
-#   ✓ Webhook/Slack notifications
-#   ✓ Encrypted backups (optional)
-#   ✓ Cloud storage upload (optional)
-#   ✓ Catalog for backup tracking
-#
-# Required Vault Variables:
-#   dbbackup_db_password
-#   dbbackup_encryption_key (if encryption enabled)
-#   dbbackup_notify_smtp_password (if SMTP enabled)
-#   dbbackup_cloud_access_key (if cloud enabled)
-#   dbbackup_cloud_secret_key (if cloud enabled)
-
-- name: Deploy dbbackup (Enterprise)
-  hosts: db_servers
-  become: yes
-  
-  vars:
-    # Full feature set
-    dbbackup_exporter_enabled: true
-    dbbackup_exporter_port: 9399
-    dbbackup_notify_enabled: true
-    
-    # GFS Retention
-    dbbackup_gfs_enabled: true
-    dbbackup_gfs_daily: 7
-    dbbackup_gfs_weekly: 4
-    dbbackup_gfs_monthly: 12
-    dbbackup_gfs_yearly: 3
-    
-  pre_tasks:
-    - name: Check for required secrets
-      assert:
-        that:
-          - dbbackup_db_password is defined
-        fail_msg: "Required secrets not provided. Use ansible-vault for dbbackup_db_password"
-
-    - name: Validate encryption key if enabled
-      assert:
-        that:
-          - dbbackup_encryption_key is defined
-          - dbbackup_encryption_key | length >= 16
-        fail_msg: "Encryption enabled but key not provided or too short"
-      when: dbbackup_encryption_enabled | default(false)
-
-  roles:
-    - dbbackup
-
-  post_tasks:
-    # Verify exporter
-    - name: Wait for exporter to start
-      wait_for:
-        port: "{{ dbbackup_exporter_port }}"
-        timeout: 30
-      when: dbbackup_exporter_enabled
-
-    - name: Test metrics endpoint
-      uri:
-        url: "http://localhost:{{ dbbackup_exporter_port }}/metrics"
-        return_content: yes
-      register: metrics_response
-      when: dbbackup_exporter_enabled
-
-    # Initialize catalog
-    - name: Sync existing backups to catalog
-      command: "{{ dbbackup_install_dir }}/dbbackup catalog sync {{ dbbackup_backup_dir }}"
-      become_user: dbbackup
-      changed_when: false
-
-    # Run preflight check
-    - name: Run preflight checks
-      command: "{{ dbbackup_install_dir }}/dbbackup preflight"
-      become_user: dbbackup
-      register: preflight_result
-      changed_when: false
-      failed_when: preflight_result.rc > 1  # rc=1 is warnings, rc=2 is failure
-
-    - name: Display preflight result
-      debug:
-        msg: "{{ preflight_result.stdout_lines }}"
-
-    # Summary
-    - name: Display deployment summary
-      debug:
-        msg: |
-          ╔══════════════════════════════════════════════════════════════╗
-          ║             dbbackup Enterprise Deployment Complete          ║
-          ╚══════════════════════════════════════════════════════════════╝
-          
-          Host: {{ inventory_hostname }}
-          Version: {{ dbbackup_version }}
-          
-          ┌─ Backup Configuration ─────────────────────────────────────────
-          │ Type: {{ dbbackup_backup_type }}
-          │ Schedule: {{ dbbackup_schedule }}
-          │ Directory: {{ dbbackup_backup_dir }}
-          │ Encryption: {{ 'Enabled' if dbbackup_encryption_enabled else 'Disabled' }}
-          └────────────────────────────────────────────────────────────────
-          
-          ┌─ Retention Policy (GFS) ───────────────────────────────────────
-          │ Daily: {{ dbbackup_gfs_daily }} backups
-          │ Weekly: {{ dbbackup_gfs_weekly }} backups
-          │ Monthly: {{ dbbackup_gfs_monthly }} backups
-          │ Yearly: {{ dbbackup_gfs_yearly }} backups
-          └────────────────────────────────────────────────────────────────
-          
-          ┌─ Monitoring ───────────────────────────────────────────────────
-          │ Prometheus: http://{{ inventory_hostname }}:{{ dbbackup_exporter_port }}/metrics
-          └────────────────────────────────────────────────────────────────
-          
-          ┌─ Notifications ────────────────────────────────────────────────
-          {% if dbbackup_notify_smtp_enabled | default(false) %}
-          │ SMTP: {{ dbbackup_notify_smtp_to | join(', ') }}
-          {% endif %}
-          {% if dbbackup_notify_slack_enabled | default(false) %}
-          │ Slack: Enabled
-          {% endif %}
-          └────────────────────────────────────────────────────────────────
-
-- name: Configure Prometheus scrape targets
-  hosts: monitoring
-  become: yes
-  tasks:
-    - name: Add dbbackup targets to prometheus
-      blockinfile:
-        path: /etc/prometheus/targets/dbbackup.yml
-        create: yes
-        block: |
-          - targets:
-          {% for host in groups['db_servers'] %}
-              - {{ host }}:{{ hostvars[host]['dbbackup_exporter_port'] | default(9399) }}
-          {% endfor %}
-            labels:
-              job: dbbackup
-      notify: reload prometheus
-      when: "'monitoring' in group_names"
-
-  handlers:
-    - name: reload prometheus
-      systemd:
-        name: prometheus
-        state: reloaded

deploy/ansible/group_vars/all.yml

@@ -1,71 +0,0 @@
-# dbbackup Ansible Variables
-# =========================
-
-# Version and Installation
-dbbackup_version: "3.42.74"
-dbbackup_download_url: "https://git.uuxo.net/UUXO/dbbackup/releases/download/v{{ dbbackup_version }}"
-dbbackup_install_dir: "/usr/local/bin"
-dbbackup_config_dir: "/etc/dbbackup"
-dbbackup_data_dir: "/var/lib/dbbackup"
-dbbackup_log_dir: "/var/log/dbbackup"
-
-# Database Configuration
-dbbackup_db_type: "postgres"  # postgres, mysql, mariadb
-dbbackup_db_host: "localhost"
-dbbackup_db_port: 5432        # 5432 for postgres, 3306 for mysql
-dbbackup_db_user: "postgres"
-# dbbackup_db_password: ""    # Use vault for passwords!
-
-# Backup Configuration
-dbbackup_backup_dir: "/var/backups/databases"
-dbbackup_backup_type: "cluster"  # cluster, single
-dbbackup_compression: 6
-dbbackup_encryption_enabled: false
-# dbbackup_encryption_key: "" # Use vault!
-
-# Schedule (systemd OnCalendar format)
-dbbackup_schedule: "daily"  # daily, weekly, *-*-* 02:00:00
-
-# Retention Policy
-dbbackup_retention_days: 30
-dbbackup_min_backups: 5
-
-# GFS Retention (enterprise.yml)
-dbbackup_gfs_enabled: false
-dbbackup_gfs_daily: 7
-dbbackup_gfs_weekly: 4
-dbbackup_gfs_monthly: 12
-dbbackup_gfs_yearly: 3
-
-# Prometheus Exporter (with-exporter.yml, enterprise.yml)
-dbbackup_exporter_enabled: false
-dbbackup_exporter_port: 9399
-
-# Cloud Storage (optional)
-dbbackup_cloud_enabled: false
-dbbackup_cloud_provider: "s3"  # s3, minio, b2, azure, gcs
-dbbackup_cloud_bucket: ""
-dbbackup_cloud_endpoint: ""    # For MinIO/B2
-# dbbackup_cloud_access_key: "" # Use vault!
-# dbbackup_cloud_secret_key: "" # Use vault!
-
-# Notifications (with-notifications.yml, enterprise.yml)
-dbbackup_notify_enabled: false
-
-# SMTP Notifications
-dbbackup_notify_smtp_enabled: false
-dbbackup_notify_smtp_host: ""
-dbbackup_notify_smtp_port: 587
-dbbackup_notify_smtp_user: ""
-# dbbackup_notify_smtp_password: "" # Use vault!
-dbbackup_notify_smtp_from: ""
-dbbackup_notify_smtp_to: []  # List of recipients
-
-# Webhook Notifications
-dbbackup_notify_webhook_enabled: false
-dbbackup_notify_webhook_url: ""
-# dbbackup_notify_webhook_secret: "" # Use vault for HMAC secret!
-
-# Slack Integration (uses webhook)
-dbbackup_notify_slack_enabled: false
-dbbackup_notify_slack_webhook: ""

deploy/ansible/inventory.example

@@ -1,25 +0,0 @@
-# dbbackup Ansible Inventory Example
-# Copy to 'inventory' and customize
-
-[db_servers]
-# PostgreSQL servers
-pg-primary.example.com   dbbackup_db_type=postgres
-pg-replica.example.com   dbbackup_db_type=postgres dbbackup_backup_from_replica=true
-
-# MySQL servers  
-mysql-01.example.com     dbbackup_db_type=mysql
-
-[db_servers:vars]
-ansible_user=deploy
-ansible_become=yes
-
-# Group-level defaults
-dbbackup_backup_dir=/var/backups/databases
-dbbackup_schedule=daily
-
-[monitoring]
-prometheus.example.com
-
-[monitoring:vars]
-# Servers where metrics are scraped
-dbbackup_exporter_enabled=true

deploy/ansible/roles/dbbackup/handlers/main.yml

@@ -1,12 +0,0 @@
----
-# dbbackup Ansible Role - Handlers
-
-- name: reload systemd
-  systemd:
-    daemon_reload: yes
-
-- name: restart dbbackup
-  systemd:
-    name: "dbbackup-{{ dbbackup_backup_type }}.service"
-    state: restarted
-  when: ansible_service_mgr == 'systemd'

deploy/ansible/roles/dbbackup/tasks/main.yml

@@ -1,116 +0,0 @@
----
-# dbbackup Ansible Role - Main Tasks
-
-- name: Create dbbackup group
-  group:
-    name: dbbackup
-    system: yes
-
-- name: Create dbbackup user
-  user:
-    name: dbbackup
-    group: dbbackup
-    system: yes
-    home: "{{ dbbackup_data_dir }}"
-    shell: /usr/sbin/nologin
-    create_home: no
-
-- name: Create directories
-  file:
-    path: "{{ item }}"
-    state: directory
-    owner: dbbackup
-    group: dbbackup
-    mode: "0755"
-  loop:
-    - "{{ dbbackup_config_dir }}"
-    - "{{ dbbackup_data_dir }}"
-    - "{{ dbbackup_data_dir }}/catalog"
-    - "{{ dbbackup_log_dir }}"
-    - "{{ dbbackup_backup_dir }}"
-
-- name: Create env.d directory
-  file:
-    path: "{{ dbbackup_config_dir }}/env.d"
-    state: directory
-    owner: root
-    group: dbbackup
-    mode: "0750"
-
-- name: Detect architecture
-  set_fact:
-    dbbackup_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}"
-
-- name: Download dbbackup binary
-  get_url:
-    url: "{{ dbbackup_download_url }}/dbbackup-linux-{{ dbbackup_arch }}"
-    dest: "{{ dbbackup_install_dir }}/dbbackup"
-    mode: "0755"
-    owner: root
-    group: root
-  notify: restart dbbackup
-
-- name: Deploy configuration file
-  template:
-    src: dbbackup.conf.j2
-    dest: "{{ dbbackup_config_dir }}/dbbackup.conf"
-    owner: root
-    group: dbbackup
-    mode: "0640"
-  notify: restart dbbackup
-
-- name: Deploy environment file
-  template:
-    src: env.j2
-    dest: "{{ dbbackup_config_dir }}/env.d/{{ dbbackup_backup_type }}.conf"
-    owner: root
-    group: dbbackup
-    mode: "0600"
-  notify: restart dbbackup
-
-- name: Install systemd service
-  command: >
-    {{ dbbackup_install_dir }}/dbbackup install
-    --backup-type {{ dbbackup_backup_type }}
-    --schedule "{{ dbbackup_schedule }}"
-    {% if dbbackup_exporter_enabled %}--with-metrics --metrics-port {{ dbbackup_exporter_port }}{% endif %}
-  args:
-    creates: "/etc/systemd/system/dbbackup-{{ dbbackup_backup_type }}.service"
-  notify:
-    - reload systemd
-    - restart dbbackup
-
-- name: Deploy systemd override (if customizations needed)
-  template:
-    src: systemd-override.conf.j2
-    dest: "/etc/systemd/system/dbbackup-{{ dbbackup_backup_type }}.service.d/override.conf"
-    owner: root
-    group: root
-    mode: "0644"
-  when: dbbackup_notify_enabled or dbbackup_cloud_enabled
-  notify:
-    - reload systemd
-    - restart dbbackup
-
-- name: Create systemd override directory
-  file:
-    path: "/etc/systemd/system/dbbackup-{{ dbbackup_backup_type }}.service.d"
-    state: directory
-    owner: root
-    group: root
-    mode: "0755"
-  when: dbbackup_notify_enabled or dbbackup_cloud_enabled
-
-- name: Enable and start dbbackup timer
-  systemd:
-    name: "dbbackup-{{ dbbackup_backup_type }}.timer"
-    enabled: yes
-    state: started
-    daemon_reload: yes
-
-- name: Enable dbbackup exporter service
-  systemd:
-    name: dbbackup-exporter
-    enabled: yes
-    state: started
-  when: dbbackup_exporter_enabled

deploy/ansible/roles/dbbackup/templates/dbbackup.conf.j2

@@ -1,39 +0,0 @@
-# dbbackup Configuration
-# Managed by Ansible - do not edit manually
-
-# Database
-db-type = {{ dbbackup_db_type }}
-host = {{ dbbackup_db_host }}
-port = {{ dbbackup_db_port }}
-user = {{ dbbackup_db_user }}
-
-# Backup
-backup-dir = {{ dbbackup_backup_dir }}
-compression = {{ dbbackup_compression }}
-
-# Retention
-retention-days = {{ dbbackup_retention_days }}
-min-backups = {{ dbbackup_min_backups }}
-
-{% if dbbackup_gfs_enabled %}
-# GFS Retention Policy
-gfs = true
-gfs-daily = {{ dbbackup_gfs_daily }}
-gfs-weekly = {{ dbbackup_gfs_weekly }}
-gfs-monthly = {{ dbbackup_gfs_monthly }}
-gfs-yearly = {{ dbbackup_gfs_yearly }}
-{% endif %}
-
-{% if dbbackup_encryption_enabled %}
-# Encryption
-encrypt = true
-{% endif %}
-
-{% if dbbackup_cloud_enabled %}
-# Cloud Storage
-cloud-provider = {{ dbbackup_cloud_provider }}
-cloud-bucket = {{ dbbackup_cloud_bucket }}
-{% if dbbackup_cloud_endpoint %}
-cloud-endpoint = {{ dbbackup_cloud_endpoint }}
-{% endif %}
-{% endif %}

deploy/ansible/roles/dbbackup/templates/env.j2

@@ -1,57 +0,0 @@
-# dbbackup Environment Variables
-# Managed by Ansible - do not edit manually
-# Permissions: 0600 (secrets inside)
-
-{% if dbbackup_db_password is defined %}
-# Database Password
-{% if dbbackup_db_type == 'postgres' %}
-PGPASSWORD={{ dbbackup_db_password }}
-{% else %}
-MYSQL_PWD={{ dbbackup_db_password }}
-{% endif %}
-{% endif %}
-
-{% if dbbackup_encryption_enabled and dbbackup_encryption_key is defined %}
-# Encryption Key
-DBBACKUP_ENCRYPTION_KEY={{ dbbackup_encryption_key }}
-{% endif %}
-
-{% if dbbackup_cloud_enabled %}
-# Cloud Storage Credentials
-{% if dbbackup_cloud_provider in ['s3', 'minio', 'b2'] %}
-AWS_ACCESS_KEY_ID={{ dbbackup_cloud_access_key | default('') }}
-AWS_SECRET_ACCESS_KEY={{ dbbackup_cloud_secret_key | default('') }}
-{% endif %}
-{% if dbbackup_cloud_provider == 'azure' %}
-AZURE_STORAGE_ACCOUNT={{ dbbackup_cloud_access_key | default('') }}
-AZURE_STORAGE_KEY={{ dbbackup_cloud_secret_key | default('') }}
-{% endif %}
-{% if dbbackup_cloud_provider == 'gcs' %}
-GOOGLE_APPLICATION_CREDENTIALS={{ dbbackup_cloud_credentials_file | default('/etc/dbbackup/gcs-credentials.json') }}
-{% endif %}
-{% endif %}
-
-{% if dbbackup_notify_smtp_enabled %}
-# SMTP Notifications
-NOTIFY_SMTP_HOST={{ dbbackup_notify_smtp_host }}
-NOTIFY_SMTP_PORT={{ dbbackup_notify_smtp_port }}
-NOTIFY_SMTP_USER={{ dbbackup_notify_smtp_user }}
-{% if dbbackup_notify_smtp_password is defined %}
-NOTIFY_SMTP_PASSWORD={{ dbbackup_notify_smtp_password }}
-{% endif %}
-NOTIFY_SMTP_FROM={{ dbbackup_notify_smtp_from }}
-NOTIFY_SMTP_TO={{ dbbackup_notify_smtp_to | join(',') }}
-{% endif %}
-
-{% if dbbackup_notify_webhook_enabled %}
-# Webhook Notifications
-NOTIFY_WEBHOOK_URL={{ dbbackup_notify_webhook_url }}
-{% if dbbackup_notify_webhook_secret is defined %}
-NOTIFY_WEBHOOK_SECRET={{ dbbackup_notify_webhook_secret }}
-{% endif %}
-{% endif %}
-
-{% if dbbackup_notify_slack_enabled %}
-# Slack Notifications
-NOTIFY_WEBHOOK_URL={{ dbbackup_notify_slack_webhook }}
-{% endif %}

deploy/ansible/roles/dbbackup/templates/systemd-override.conf.j2

@@ -1,6 +0,0 @@
-# dbbackup Systemd Override
-# Managed by Ansible
-
-[Service]
-# Load environment from secure file
-EnvironmentFile=-{{ dbbackup_config_dir }}/env.d/{{ dbbackup_backup_type }}.conf

deploy/ansible/with-exporter.yml

@@ -1,52 +0,0 @@
----
-# dbbackup with Prometheus Exporter
-# Installation with metrics endpoint for monitoring
-#
-# Usage:
-#   ansible-playbook -i inventory with-exporter.yml
-#
-# Features:
-#   ✓ Automated daily backups
-#   ✓ Retention policy
-#   ✓ Prometheus exporter on port 9399
-#   ✗ No notifications
-
-- name: Deploy dbbackup with Prometheus exporter
-  hosts: db_servers
-  become: yes
-  
-  vars:
-    dbbackup_exporter_enabled: true
-    dbbackup_exporter_port: 9399
-    dbbackup_notify_enabled: false
-  
-  roles:
-    - dbbackup
-
-  post_tasks:
-    - name: Wait for exporter to start
-      wait_for:
-        port: "{{ dbbackup_exporter_port }}"
-        timeout: 30
-
-    - name: Test metrics endpoint
-      uri:
-        url: "http://localhost:{{ dbbackup_exporter_port }}/metrics"
-        return_content: yes
-      register: metrics_response
-
-    - name: Verify metrics available
-      assert:
-        that:
-          - "'dbbackup_' in metrics_response.content"
-        fail_msg: "Metrics endpoint not returning dbbackup metrics"
-        success_msg: "Prometheus exporter running on port {{ dbbackup_exporter_port }}"
-
-    - name: Display Prometheus scrape config
-      debug:
-        msg: |
-          Add to prometheus.yml:
-          
-          - job_name: 'dbbackup'
-            static_configs:
-              - targets: ['{{ inventory_hostname }}:{{ dbbackup_exporter_port }}']

deploy/ansible/with-notifications.yml

@@ -1,84 +0,0 @@
----
-# dbbackup with Notifications
-# Installation with SMTP email and/or webhook notifications
-#
-# Usage:
-#   # With SMTP notifications
-#   ansible-playbook -i inventory with-notifications.yml \
-#     -e dbbackup_notify_smtp_enabled=true \
-#     -e dbbackup_notify_smtp_host=smtp.example.com \
-#     -e dbbackup_notify_smtp_from=backups@example.com \
-#     -e '{"dbbackup_notify_smtp_to": ["admin@example.com", "dba@example.com"]}'
-#
-#   # With Slack notifications
-#   ansible-playbook -i inventory with-notifications.yml \
-#     -e dbbackup_notify_slack_enabled=true \
-#     -e dbbackup_notify_slack_webhook=https://hooks.slack.com/services/XXX
-#
-# Features:
-#   ✓ Automated daily backups
-#   ✓ Retention policy
-#   ✗ No Prometheus exporter
-#   ✓ Email notifications (optional)
-#   ✓ Webhook/Slack notifications (optional)
-
-- name: Deploy dbbackup with notifications
-  hosts: db_servers
-  become: yes
-  
-  vars:
-    dbbackup_exporter_enabled: false
-    dbbackup_notify_enabled: true
-    # Enable one or more notification methods:
-    # dbbackup_notify_smtp_enabled: true
-    # dbbackup_notify_webhook_enabled: true
-    # dbbackup_notify_slack_enabled: true
-  
-  pre_tasks:
-    - name: Validate notification configuration
-      assert:
-        that:
-          - dbbackup_notify_smtp_enabled or dbbackup_notify_webhook_enabled or dbbackup_notify_slack_enabled
-        fail_msg: "At least one notification method must be enabled"
-        success_msg: "Notification configuration valid"
-
-    - name: Validate SMTP configuration
-      assert:
-        that:
-          - dbbackup_notify_smtp_host != ''
-          - dbbackup_notify_smtp_from != ''
-          - dbbackup_notify_smtp_to | length > 0
-        fail_msg: "SMTP configuration incomplete"
-      when: dbbackup_notify_smtp_enabled | default(false)
-
-    - name: Validate webhook configuration
-      assert:
-        that:
-          - dbbackup_notify_webhook_url != ''
-        fail_msg: "Webhook URL required"
-      when: dbbackup_notify_webhook_enabled | default(false)
-
-    - name: Validate Slack configuration
-      assert:
-        that:
-          - dbbackup_notify_slack_webhook != ''
-        fail_msg: "Slack webhook URL required"
-      when: dbbackup_notify_slack_enabled | default(false)
-
-  roles:
-    - dbbackup
-
-  post_tasks:
-    - name: Display notification configuration
-      debug:
-        msg: |
-          Notifications configured:
-          {% if dbbackup_notify_smtp_enabled | default(false) %}
-          - SMTP: {{ dbbackup_notify_smtp_to | join(', ') }}
-          {% endif %}
-          {% if dbbackup_notify_webhook_enabled | default(false) %}
-          - Webhook: {{ dbbackup_notify_webhook_url }}
-          {% endif %}
-          {% if dbbackup_notify_slack_enabled | default(false) %}
-          - Slack: Enabled
-          {% endif %}

deploy/kubernetes/README.md

@@ -1,48 +0,0 @@
-# dbbackup Kubernetes Deployment
-
-Kubernetes manifests for running dbbackup as scheduled CronJobs.
-
-## Quick Start
-
-```bash
-# Create namespace
-kubectl create namespace dbbackup
-
-# Create secrets
-kubectl create secret generic dbbackup-db-credentials \
-  --namespace dbbackup \
-  --from-literal=password=your-db-password
-
-# Apply manifests
-kubectl apply -f . --namespace dbbackup
-
-# Check CronJob
-kubectl get cronjobs -n dbbackup
-```
-
-## Components
-
-- `configmap.yaml` - Configuration settings
-- `secret.yaml` - Credentials template (use kubectl create secret instead)
-- `cronjob.yaml` - Scheduled backup job
-- `pvc.yaml` - Persistent volume for backup storage
-- `servicemonitor.yaml` - Prometheus ServiceMonitor (optional)
-
-## Customization
-
-Edit `configmap.yaml` to configure:
-- Database connection
-- Backup schedule
-- Retention policy
-- Cloud storage
-
-## Helm Chart
-
-For more complex deployments, use the Helm chart:
-
-```bash
-helm install dbbackup ./helm/dbbackup \
-  --set database.host=postgres.default.svc \
-  --set database.password=secret \
-  --set schedule="0 2 * * *"
-```

deploy/kubernetes/configmap.yaml

@@ -1,27 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: dbbackup-config
-  labels:
-    app: dbbackup
-data:
-  # Database Configuration
-  DB_TYPE: "postgres"
-  DB_HOST: "postgres.default.svc.cluster.local"
-  DB_PORT: "5432"
-  DB_USER: "postgres"
-  
-  # Backup Configuration
-  BACKUP_DIR: "/backups"
-  COMPRESSION: "6"
-  
-  # Retention
-  RETENTION_DAYS: "30"
-  MIN_BACKUPS: "5"
-  
-  # GFS Retention (enterprise)
-  GFS_ENABLED: "false"
-  GFS_DAILY: "7"
-  GFS_WEEKLY: "4"
-  GFS_MONTHLY: "12"
-  GFS_YEARLY: "3"

deploy/kubernetes/cronjob.yaml

@@ -1,140 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: dbbackup-cluster
-  labels:
-    app: dbbackup
-    component: backup
-spec:
-  # Daily at 2:00 AM UTC
-  schedule: "0 2 * * *"
-  
-  # Keep last 3 successful and 1 failed job
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 1
-  
-  # Don't run if previous job is still running
-  concurrencyPolicy: Forbid
-  
-  # Start job within 5 minutes of scheduled time or skip
-  startingDeadlineSeconds: 300
-  
-  jobTemplate:
-    spec:
-      # Retry up to 2 times on failure
-      backoffLimit: 2
-      
-      template:
-        metadata:
-          labels:
-            app: dbbackup
-            component: backup
-        spec:
-          restartPolicy: OnFailure
-          
-          # Security context
-          securityContext:
-            runAsNonRoot: true
-            runAsUser: 1000
-            fsGroup: 1000
-          
-          containers:
-          - name: dbbackup
-            image: git.uuxo.net/uuxo/dbbackup:latest
-            imagePullPolicy: IfNotPresent
-            
-            args:
-              - backup
-              - cluster
-              - --compression
-              - "$(COMPRESSION)"
-            
-            envFrom:
-              - configMapRef:
-                  name: dbbackup-config
-              - secretRef:
-                  name: dbbackup-secrets
-            
-            env:
-              - name: BACKUP_DIR
-                value: /backups
-            
-            volumeMounts:
-              - name: backup-storage
-                mountPath: /backups
-            
-            resources:
-              requests:
-                memory: "256Mi"
-                cpu: "100m"
-              limits:
-                memory: "2Gi"
-                cpu: "2000m"
-          
-          volumes:
-            - name: backup-storage
-              persistentVolumeClaim:
-                claimName: dbbackup-storage
-
----
-# Cleanup CronJob - runs weekly
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: dbbackup-cleanup
-  labels:
-    app: dbbackup
-    component: cleanup
-spec:
-  # Weekly on Sunday at 3:00 AM UTC
-  schedule: "0 3 * * 0"
-  successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 1
-  concurrencyPolicy: Forbid
-  
-  jobTemplate:
-    spec:
-      template:
-        metadata:
-          labels:
-            app: dbbackup
-            component: cleanup
-        spec:
-          restartPolicy: OnFailure
-          securityContext:
-            runAsNonRoot: true
-            runAsUser: 1000
-            fsGroup: 1000
-          
-          containers:
-          - name: dbbackup
-            image: git.uuxo.net/uuxo/dbbackup:latest
-            
-            args:
-              - cleanup
-              - /backups
-              - --retention-days
-              - "$(RETENTION_DAYS)"
-              - --min-backups
-              - "$(MIN_BACKUPS)"
-            
-            envFrom:
-              - configMapRef:
-                  name: dbbackup-config
-            
-            volumeMounts:
-              - name: backup-storage
-                mountPath: /backups
-            
-            resources:
-              requests:
-                memory: "128Mi"
-                cpu: "50m"
-              limits:
-                memory: "512Mi"
-                cpu: "500m"
-          
-          volumes:
-            - name: backup-storage
-              persistentVolumeClaim:
-                claimName: dbbackup-storage

deploy/kubernetes/pvc.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: dbbackup-storage
-  labels:
-    app: dbbackup
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 100Gi  # Adjust based on database size
-  # storageClassName: fast-ssd  # Uncomment for specific storage class

deploy/kubernetes/secret.yaml.example

@@ -1,27 +0,0 @@
-# dbbackup Secrets Template
-# DO NOT commit this file with real credentials!
-# Use: kubectl create secret generic dbbackup-secrets --from-literal=...
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: dbbackup-secrets
-  labels:
-    app: dbbackup
-type: Opaque
-stringData:
-  # Database Password (required)
-  PGPASSWORD: "CHANGE_ME"
-  
-  # Encryption Key (optional - 32+ characters recommended)
-  # DBBACKUP_ENCRYPTION_KEY: "your-encryption-key-here"
-  
-  # Cloud Storage Credentials (optional)
-  # AWS_ACCESS_KEY_ID: "AKIAXXXXXXXX"
-  # AWS_SECRET_ACCESS_KEY: "your-secret-key"
-  
-  # SMTP Notifications (optional)
-  # NOTIFY_SMTP_PASSWORD: "smtp-password"
-  
-  # Webhook Secret (optional)
-  # NOTIFY_WEBHOOK_SECRET: "hmac-signing-secret"

deploy/kubernetes/servicemonitor.yaml

@@ -1,114 +0,0 @@
-# Prometheus ServiceMonitor for dbbackup
-# Requires prometheus-operator
-
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: dbbackup
-  labels:
-    app: dbbackup
-    release: prometheus  # Match your Prometheus operator release
-spec:
-  selector:
-    matchLabels:
-      app: dbbackup
-      component: exporter
-  endpoints:
-    - port: metrics
-      interval: 60s
-      path: /metrics
-  namespaceSelector:
-    matchNames:
-      - dbbackup
-
----
-# Metrics exporter deployment (optional - for continuous metrics)
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: dbbackup-exporter
-  labels:
-    app: dbbackup
-    component: exporter
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: dbbackup
-      component: exporter
-  template:
-    metadata:
-      labels:
-        app: dbbackup
-        component: exporter
-    spec:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-      
-      containers:
-      - name: exporter
-        image: git.uuxo.net/uuxo/dbbackup:latest
-        args:
-          - metrics
-          - serve
-          - --port
-          - "9399"
-        
-        ports:
-          - name: metrics
-            containerPort: 9399
-            protocol: TCP
-        
-        envFrom:
-          - configMapRef:
-              name: dbbackup-config
-        
-        volumeMounts:
-          - name: backup-storage
-            mountPath: /backups
-            readOnly: true
-        
-        livenessProbe:
-          httpGet:
-            path: /health
-            port: metrics
-          initialDelaySeconds: 10
-          periodSeconds: 30
-        
-        readinessProbe:
-          httpGet:
-            path: /health
-            port: metrics
-          initialDelaySeconds: 5
-          periodSeconds: 10
-        
-        resources:
-          requests:
-            memory: "64Mi"
-            cpu: "10m"
-          limits:
-            memory: "128Mi"
-            cpu: "100m"
-      
-      volumes:
-        - name: backup-storage
-          persistentVolumeClaim:
-            claimName: dbbackup-storage
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: dbbackup-exporter
-  labels:
-    app: dbbackup
-    component: exporter
-spec:
-  ports:
-    - name: metrics
-      port: 9399
-      targetPort: metrics
-  selector:
-    app: dbbackup
-    component: exporter

deploy/prometheus/alerting-rules.yaml

@@ -1,168 +0,0 @@
-# Prometheus Alerting Rules for dbbackup
-# Import into your Prometheus/Alertmanager configuration
-
-groups:
-  - name: dbbackup
-    rules:
-      # RPO Alerts - Recovery Point Objective violations
-      - alert: DBBackupRPOWarning
-        expr: dbbackup_rpo_seconds > 43200  # 12 hours
-        for: 5m
-        labels:
-          severity: warning
-        annotations:
-          summary: "Database backup RPO warning on {{ $labels.server }}"
-          description: "No successful backup for {{ $labels.database }} in {{ $value | humanizeDuration }}. RPO threshold: 12 hours."
-
-      - alert: DBBackupRPOCritical
-        expr: dbbackup_rpo_seconds > 86400  # 24 hours
-        for: 5m
-        labels:
-          severity: critical
-        annotations:
-          summary: "Database backup RPO critical on {{ $labels.server }}"
-          description: "No successful backup for {{ $labels.database }} in {{ $value | humanizeDuration }}. Immediate attention required!"
-          runbook_url: "https://wiki.example.com/runbooks/dbbackup-rpo-violation"
-
-      # Backup Failure Alerts
-      - alert: DBBackupFailed
-        expr: increase(dbbackup_backup_total{status="failure"}[1h]) > 0
-        for: 1m
-        labels:
-          severity: critical
-        annotations:
-          summary: "Database backup failed on {{ $labels.server }}"
-          description: "Backup for {{ $labels.database }} failed. Check logs for details."
-
-      - alert: DBBackupFailureRateHigh
-        expr: |
-          rate(dbbackup_backup_total{status="failure"}[24h]) 
-          / 
-          rate(dbbackup_backup_total[24h]) > 0.1
-        for: 1h
-        labels:
-          severity: warning
-        annotations:
-          summary: "High backup failure rate on {{ $labels.server }}"
-          description: "More than 10% of backups are failing over the last 24 hours."
-
-      # Backup Size Anomalies
-      - alert: DBBackupSizeAnomaly
-        expr: |
-          abs(
-            dbbackup_last_backup_size_bytes 
-            - avg_over_time(dbbackup_last_backup_size_bytes[7d])
-          ) 
-          / avg_over_time(dbbackup_last_backup_size_bytes[7d]) > 0.5
-        for: 5m
-        labels:
-          severity: warning
-        annotations:
-          summary: "Backup size anomaly for {{ $labels.database }}"
-          description: "Backup size changed by more than 50% compared to 7-day average. Current: {{ $value | humanize1024 }}B"
-
-      - alert: DBBackupSizeZero
-        expr: dbbackup_last_backup_size_bytes == 0
-        for: 5m
-        labels:
-          severity: critical
-        annotations:
-          summary: "Zero-size backup detected for {{ $labels.database }}"
-          description: "Last backup file is empty. Backup likely failed silently."
-
-      # Duration Alerts
-      - alert: DBBackupDurationHigh
-        expr: dbbackup_last_backup_duration_seconds > 3600  # 1 hour
-        for: 5m
-        labels:
-          severity: warning
-        annotations:
-          summary: "Backup taking too long for {{ $labels.database }}"
-          description: "Last backup took {{ $value | humanizeDuration }}. Consider optimizing backup strategy."
-
-      # Verification Alerts
-      - alert: DBBackupNotVerified
-        expr: dbbackup_backup_verified == 0
-        for: 24h
-        labels:
-          severity: warning
-        annotations:
-          summary: "Backup not verified for {{ $labels.database }}"
-          description: "Last backup was not verified. Run dbbackup verify to check integrity."
-
-      # PITR Alerts
-      - alert: DBBackupPITRArchiveLag
-        expr: dbbackup_pitr_archive_lag_seconds > 600
-        for: 5m
-        labels:
-          severity: warning
-        annotations:
-          summary: "PITR archive lag on {{ $labels.server }}"
-          description: "WAL/binlog archiving for {{ $labels.database }} is {{ $value | humanizeDuration }} behind."
-
-      - alert: DBBackupPITRArchiveCritical
-        expr: dbbackup_pitr_archive_lag_seconds > 1800
-        for: 5m
-        labels:
-          severity: critical
-        annotations:
-          summary: "PITR archive critically behind on {{ $labels.server }}"
-          description: "WAL/binlog archiving for {{ $labels.database }} is {{ $value | humanizeDuration }} behind. PITR capability at risk!"
-
-      - alert: DBBackupPITRChainBroken
-        expr: dbbackup_pitr_chain_valid == 0
-        for: 1m
-        labels:
-          severity: critical
-        annotations:
-          summary: "PITR chain broken for {{ $labels.database }}"
-          description: "WAL/binlog chain has gaps. Point-in-time recovery NOT possible. New base backup required."
-
-      - alert: DBBackupPITRGaps
-        expr: dbbackup_pitr_gap_count > 0
-        for: 5m
-        labels:
-          severity: warning
-        annotations:
-          summary: "PITR chain gaps for {{ $labels.database }}"
-          description: "{{ $value }} gaps in WAL/binlog chain. Recovery to points within gaps will fail."
-
-      # Backup Type Alerts
-      - alert: DBBackupNoRecentFull
-        expr: time() - dbbackup_last_success_timestamp{backup_type="full"} > 604800
-        for: 1h
-        labels:
-          severity: warning
-        annotations:
-          summary: "No full backup in 7+ days for {{ $labels.database }}"
-          description: "Consider taking a full backup. Incremental chains depend on valid base."
-
-      # Exporter Health
-      - alert: DBBackupExporterDown
-        expr: up{job="dbbackup"} == 0
-        for: 5m
-        labels:
-          severity: critical
-        annotations:
-          summary: "dbbackup exporter is down on {{ $labels.instance }}"
-          description: "Cannot scrape metrics from dbbackup exporter. Monitoring is impaired."
-
-      # Deduplication Alerts
-      - alert: DBBackupDedupRatioLow
-        expr: dbbackup_dedup_ratio < 0.2
-        for: 24h
-        labels:
-          severity: info
-        annotations:
-          summary: "Low deduplication ratio on {{ $labels.server }}"
-          description: "Dedup ratio is {{ $value | printf \"%.1f%%\" }}. Consider if dedup is beneficial."
-
-      # Storage Alerts
-      - alert: DBBackupStorageHigh
-        expr: dbbackup_dedup_disk_usage_bytes > 1099511627776  # 1 TB
-        for: 1h
-        labels:
-          severity: warning
-        annotations:
-          summary: "High backup storage usage on {{ $labels.server }}"
-          description: "Backup storage using {{ $value | humanize1024 }}B. Review retention policy."

deploy/prometheus/scrape-config.yaml

@@ -1,48 +0,0 @@
-# Prometheus scrape configuration for dbbackup
-# Add to your prometheus.yml
-
-scrape_configs:
-  - job_name: 'dbbackup'
-    # Scrape interval - backup metrics don't change frequently
-    scrape_interval: 60s
-    scrape_timeout: 10s
-    
-    # Static targets - list your database servers
-    static_configs:
-      - targets:
-          - 'db-server-01:9399'
-          - 'db-server-02:9399'
-          - 'db-server-03:9399'
-        labels:
-          environment: 'production'
-      
-      - targets:
-          - 'db-staging:9399'
-        labels:
-          environment: 'staging'
-    
-    # Relabeling (optional)
-    relabel_configs:
-      # Extract hostname from target
-      - source_labels: [__address__]
-        target_label: instance
-        regex: '([^:]+):\d+'
-        replacement: '$1'
-
-# Alternative: File-based service discovery
-# Useful when targets are managed by Ansible/Terraform
-
-  - job_name: 'dbbackup-sd'
-    scrape_interval: 60s
-    file_sd_configs:
-      - files:
-          - '/etc/prometheus/targets/dbbackup/*.yml'
-        refresh_interval: 5m
-
-# Example target file (/etc/prometheus/targets/dbbackup/production.yml):
-# - targets:
-#     - db-server-01:9399
-#     - db-server-02:9399
-#   labels:
-#     environment: production
-#     datacenter: us-east-1

deploy/scripts/backup-rotation.sh

@@ -1,65 +0,0 @@
-#!/bin/bash
-# Backup Rotation Script for dbbackup
-# Implements GFS (Grandfather-Father-Son) retention policy
-#
-# Usage: backup-rotation.sh /path/to/backups [--dry-run]
-
-set -euo pipefail
-
-BACKUP_DIR="${1:-/var/backups/databases}"
-DRY_RUN="${2:-}"
-
-# GFS Configuration
-DAILY_KEEP=7
-WEEKLY_KEEP=4
-MONTHLY_KEEP=12
-YEARLY_KEEP=3
-
-# Minimum backups to always keep
-MIN_BACKUPS=5
-
-echo "═══════════════════════════════════════════════════════════════"
-echo "  dbbackup GFS Rotation"
-echo "═══════════════════════════════════════════════════════════════"
-echo ""
-echo "  Backup Directory: $BACKUP_DIR"
-echo "  Retention Policy:"
-echo "    Daily:   $DAILY_KEEP backups"
-echo "    Weekly:  $WEEKLY_KEEP backups"  
-echo "    Monthly: $MONTHLY_KEEP backups"
-echo "    Yearly:  $YEARLY_KEEP backups"
-echo ""
-
-if [[ "$DRY_RUN" == "--dry-run" ]]; then
-    echo "  [DRY RUN MODE - No files will be deleted]"
-    echo ""
-fi
-
-# Check if dbbackup is available
-if ! command -v dbbackup &> /dev/null; then
-    echo "ERROR: dbbackup command not found"
-    exit 1
-fi
-
-# Build cleanup command
-CLEANUP_CMD="dbbackup cleanup $BACKUP_DIR \
-    --gfs \
-    --gfs-daily $DAILY_KEEP \
-    --gfs-weekly $WEEKLY_KEEP \
-    --gfs-monthly $MONTHLY_KEEP \
-    --gfs-yearly $YEARLY_KEEP \
-    --min-backups $MIN_BACKUPS"
-
-if [[ "$DRY_RUN" == "--dry-run" ]]; then
-    CLEANUP_CMD="$CLEANUP_CMD --dry-run"
-fi
-
-echo "Running: $CLEANUP_CMD"
-echo ""
-
-$CLEANUP_CMD
-
-echo ""
-echo "═══════════════════════════════════════════════════════════════"
-echo "  Rotation complete"
-echo "═══════════════════════════════════════════════════════════════"

deploy/scripts/health-check.sh

@@ -1,92 +0,0 @@
-#!/bin/bash
-# Health Check Script for dbbackup
-# Returns exit codes for monitoring systems:
-#   0 = OK (backup within RPO)
-#   1 = WARNING (backup older than warning threshold)
-#   2 = CRITICAL (backup older than critical threshold or missing)
-#
-# Usage: health-check.sh [backup-dir] [warning-hours] [critical-hours]
-
-set -euo pipefail
-
-BACKUP_DIR="${1:-/var/backups/databases}"
-WARNING_HOURS="${2:-24}"
-CRITICAL_HOURS="${3:-48}"
-
-# Convert to seconds
-WARNING_SECONDS=$((WARNING_HOURS * 3600))
-CRITICAL_SECONDS=$((CRITICAL_HOURS * 3600))
-
-echo "dbbackup Health Check"
-echo "====================="
-echo "Backup directory: $BACKUP_DIR"
-echo "Warning threshold: ${WARNING_HOURS}h"
-echo "Critical threshold: ${CRITICAL_HOURS}h"
-echo ""
-
-# Check if backup directory exists
-if [[ ! -d "$BACKUP_DIR" ]]; then
-    echo "CRITICAL: Backup directory does not exist"
-    exit 2
-fi
-
-# Find most recent backup file
-LATEST_BACKUP=$(find "$BACKUP_DIR" -type f \( -name "*.dump" -o -name "*.dump.gz" -o -name "*.sql" -o -name "*.sql.gz" -o -name "*.tar.gz" \) -printf '%T@ %p\n' 2>/dev/null | sort -rn | head -1)
-
-if [[ -z "$LATEST_BACKUP" ]]; then
-    echo "CRITICAL: No backup files found in $BACKUP_DIR"
-    exit 2
-fi
-
-# Extract timestamp and path
-BACKUP_TIMESTAMP=$(echo "$LATEST_BACKUP" | cut -d' ' -f1 | cut -d'.' -f1)
-BACKUP_PATH=$(echo "$LATEST_BACKUP" | cut -d' ' -f2-)
-BACKUP_NAME=$(basename "$BACKUP_PATH")
-
-# Calculate age
-NOW=$(date +%s)
-AGE_SECONDS=$((NOW - BACKUP_TIMESTAMP))
-AGE_HOURS=$((AGE_SECONDS / 3600))
-AGE_DAYS=$((AGE_HOURS / 24))
-
-# Format age string
-if [[ $AGE_DAYS -gt 0 ]]; then
-    AGE_STR="${AGE_DAYS}d $((AGE_HOURS % 24))h"
-else
-    AGE_STR="${AGE_HOURS}h $((AGE_SECONDS % 3600 / 60))m"
-fi
-
-# Get backup size
-BACKUP_SIZE=$(du -h "$BACKUP_PATH" 2>/dev/null | cut -f1)
-
-echo "Latest backup:"
-echo "  File: $BACKUP_NAME"
-echo "  Size: $BACKUP_SIZE"
-echo "  Age:  $AGE_STR"
-echo ""
-
-# Verify backup integrity if dbbackup is available
-if command -v dbbackup &> /dev/null; then
-    echo "Verifying backup integrity..."
-    if dbbackup verify "$BACKUP_PATH" --quiet 2>/dev/null; then
-        echo "  ✓ Backup integrity verified"
-    else
-        echo "  ✗ Backup verification failed"
-        echo ""
-        echo "CRITICAL: Latest backup is corrupted"
-        exit 2
-    fi
-    echo ""
-fi
-
-# Check thresholds
-if [[ $AGE_SECONDS -ge $CRITICAL_SECONDS ]]; then
-    echo "CRITICAL: Last backup is ${AGE_STR} old (threshold: ${CRITICAL_HOURS}h)"
-    exit 2
-elif [[ $AGE_SECONDS -ge $WARNING_SECONDS ]]; then
-    echo "WARNING: Last backup is ${AGE_STR} old (threshold: ${WARNING_HOURS}h)"
-    exit 1
-else
-    echo "OK: Last backup is ${AGE_STR} old"
-    exit 0
-fi

deploy/terraform/aws/example.tf

@@ -1,26 +0,0 @@
-# dbbackup Terraform - AWS Example
-
-variable "aws_region" {
-  default = "us-east-1"
-}
-
-provider "aws" {
-  region = var.aws_region
-}
-
-module "dbbackup_storage" {
-  source = "./main.tf"
-  
-  environment    = "production"
-  bucket_name    = "mycompany-database-backups"
-  retention_days = 30
-  glacier_days   = 365
-}
-
-output "bucket_name" {
-  value = module.dbbackup_storage.bucket_name
-}
-
-output "setup_instructions" {
-  value = module.dbbackup_storage.dbbackup_cloud_config
-}

deploy/terraform/aws/main.tf

@@ -1,202 +0,0 @@
-# dbbackup Terraform Module - AWS Deployment
-# Creates S3 bucket for backup storage with proper security
-
-terraform {
-  required_version = ">= 1.0"
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = ">= 4.0"
-    }
-  }
-}
-
-# Variables
-variable "environment" {
-  description = "Environment name (e.g., production, staging)"
-  type        = string
-  default     = "production"
-}
-
-variable "bucket_name" {
-  description = "S3 bucket name for backups"
-  type        = string
-}
-
-variable "retention_days" {
-  description = "Days to keep backups before transitioning to Glacier"
-  type        = number
-  default     = 30
-}
-
-variable "glacier_days" {
-  description = "Days to keep in Glacier before deletion (0 = keep forever)"
-  type        = number
-  default     = 365
-}
-
-variable "enable_encryption" {
-  description = "Enable server-side encryption"
-  type        = bool
-  default     = true
-}
-
-variable "kms_key_arn" {
-  description = "KMS key ARN for encryption (leave empty for aws/s3 managed key)"
-  type        = string
-  default     = ""
-}
-
-# S3 Bucket
-resource "aws_s3_bucket" "backups" {
-  bucket = var.bucket_name
-  
-  tags = {
-    Name        = "Database Backups"
-    Environment = var.environment
-    ManagedBy   = "terraform"
-    Application = "dbbackup"
-  }
-}
-
-# Versioning
-resource "aws_s3_bucket_versioning" "backups" {
-  bucket = aws_s3_bucket.backups.id
-  versioning_configuration {
-    status = "Enabled"
-  }
-}
-
-# Encryption
-resource "aws_s3_bucket_server_side_encryption_configuration" "backups" {
-  count  = var.enable_encryption ? 1 : 0
-  bucket = aws_s3_bucket.backups.id
-
-  rule {
-    apply_server_side_encryption_by_default {
-      sse_algorithm     = var.kms_key_arn != "" ? "aws:kms" : "AES256"
-      kms_master_key_id = var.kms_key_arn != "" ? var.kms_key_arn : null
-    }
-    bucket_key_enabled = true
-  }
-}
-
-# Lifecycle Rules
-resource "aws_s3_bucket_lifecycle_configuration" "backups" {
-  bucket = aws_s3_bucket.backups.id
-
-  rule {
-    id     = "transition-to-glacier"
-    status = "Enabled"
-
-    filter {
-      prefix = ""
-    }
-
-    transition {
-      days          = var.retention_days
-      storage_class = "GLACIER"
-    }
-
-    dynamic "expiration" {
-      for_each = var.glacier_days > 0 ? [1] : []
-      content {
-        days = var.retention_days + var.glacier_days
-      }
-    }
-
-    noncurrent_version_transition {
-      noncurrent_days = 30
-      storage_class   = "GLACIER"
-    }
-
-    noncurrent_version_expiration {
-      noncurrent_days = 90
-    }
-  }
-}
-
-# Block Public Access
-resource "aws_s3_bucket_public_access_block" "backups" {
-  bucket = aws_s3_bucket.backups.id
-
-  block_public_acls       = true
-  block_public_policy     = true
-  ignore_public_acls      = true
-  restrict_public_buckets = true
-}
-
-# IAM User for dbbackup
-resource "aws_iam_user" "dbbackup" {
-  name = "dbbackup-${var.environment}"
-  path = "/service-accounts/"
-  
-  tags = {
-    Application = "dbbackup"
-    Environment = var.environment
-  }
-}
-
-resource "aws_iam_access_key" "dbbackup" {
-  user = aws_iam_user.dbbackup.name
-}
-
-# IAM Policy
-resource "aws_iam_user_policy" "dbbackup" {
-  name = "dbbackup-s3-access"
-  user = aws_iam_user.dbbackup.name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "s3:GetObject",
-          "s3:PutObject",
-          "s3:DeleteObject",
-          "s3:ListBucket",
-          "s3:GetBucketLocation"
-        ]
-        Resource = [
-          aws_s3_bucket.backups.arn,
-          "${aws_s3_bucket.backups.arn}/*"
-        ]
-      }
-    ]
-  })
-}
-
-# Outputs
-output "bucket_name" {
-  description = "S3 bucket name"
-  value       = aws_s3_bucket.backups.id
-}
-
-output "bucket_arn" {
-  description = "S3 bucket ARN"
-  value       = aws_s3_bucket.backups.arn
-}
-
-output "access_key_id" {
-  description = "IAM access key ID for dbbackup"
-  value       = aws_iam_access_key.dbbackup.id
-}
-
-output "secret_access_key" {
-  description = "IAM secret access key for dbbackup"
-  value       = aws_iam_access_key.dbbackup.secret
-  sensitive   = true
-}
-
-output "dbbackup_cloud_config" {
-  description = "Cloud configuration for dbbackup"
-  value       = <<-EOT
-    # Add to dbbackup environment:
-    export AWS_ACCESS_KEY_ID="${aws_iam_access_key.dbbackup.id}"
-    export AWS_SECRET_ACCESS_KEY="<run: terraform output -raw secret_access_key>"
-    
-    # Use with dbbackup:
-    dbbackup backup cluster --cloud s3://${aws_s3_bucket.backups.id}/backups/
-  EOT
-}

docs/CATALOG.md

@@ -1,339 +0,0 @@
-# Backup Catalog
-
-Complete reference for the dbbackup catalog system for tracking, managing, and analyzing backup inventory.
-
-## Overview
-
-The catalog is a SQLite database that tracks all backups, providing:
-- Backup gap detection (missing scheduled backups)
-- Retention policy compliance verification
-- Backup integrity tracking
-- Historical retention enforcement
-- Full-text search over backup metadata
-
-## Quick Start
-
-```bash
-# Initialize catalog (automatic on first use)
-dbbackup catalog sync /mnt/backups/databases
-
-# List all backups in catalog
-dbbackup catalog list
-
-# Show catalog statistics
-dbbackup catalog stats
-
-# View backup details
-dbbackup catalog info mydb_2026-01-23.dump.gz
-
-# Search for backups
-dbbackup catalog search --database myapp --after 2026-01-01
-```
-
-## Catalog Sync
-
-Syncs local backup directory with catalog database.
-
-```bash
-# Sync all backups in directory
-dbbackup catalog sync /mnt/backups/databases
-
-# Force rescan (useful if backups were added manually)
-dbbackup catalog sync /mnt/backups/databases --force
-
-# Sync specific database backups
-dbbackup catalog sync /mnt/backups/databases --database myapp
-
-# Dry-run to see what would be synced
-dbbackup catalog sync /mnt/backups/databases --dry-run
-```
-
-Catalog entries include:
-- Backup filename
-- Database name
-- Backup timestamp
-- Size (bytes)
-- Compression ratio
-- Encryption status
-- Backup type (full/incremental/pitr_base)
-- Retention status
-- Checksum/hash
-
-## Listing Backups
-
-### Show All Backups
-
-```bash
-dbbackup catalog list
-```
-
-Output format:
-```
-Database        Timestamp            Size        Compressed  Encrypted  Verified  Type
-myapp           2026-01-23 14:30:00  2.5 GB      62%         yes        yes       full
-myapp           2026-01-23 02:00:00  1.2 GB      58%         yes        yes       incremental
-mydb            2026-01-23 22:15:00  856 MB      64%         no         no        full
-```
-
-### Filter by Database
-
-```bash
-dbbackup catalog list --database myapp
-```
-
-### Filter by Date Range
-
-```bash
-dbbackup catalog list --after 2026-01-01 --before 2026-01-31
-```
-
-### Sort Results
-
-```bash
-dbbackup catalog list --sort size --reverse     # Largest first
-dbbackup catalog list --sort date              # Oldest first
-dbbackup catalog list --sort verified           # Verified first
-```
-
-## Statistics and Gaps
-
-### Show Catalog Statistics
-
-```bash
-dbbackup catalog stats
-```
-
-Output includes:
-- Total backups
-- Total size stored
-- Unique databases
-- Success/failure ratio
-- Oldest/newest backup
-- Average backup size
-
-### Detect Backup Gaps
-
-Gaps are missing expected backups based on schedule.
-
-```bash
-# Show gaps in mydb backups (assuming daily schedule)
-dbbackup catalog gaps mydb --interval 24h
-
-# 12-hour interval
-dbbackup catalog gaps mydb --interval 12h
-
-# Show as calendar grid
-dbbackup catalog gaps mydb --interval 24h --calendar
-
-# Define custom work hours (backup only weekdays 02:00)
-dbbackup catalog gaps mydb --interval 24h --workdays-only
-```
-
-Output shows:
-- Dates with missing backups
-- Expected backup count
-- Actual backup count
-- Gap duration
-- Reasons (if known)
-
-## Searching
-
-Full-text search across backup metadata.
-
-```bash
-# Search by database name
-dbbackup catalog search --database myapp
-
-# Search by date
-dbbackup catalog search --after 2026-01-01 --before 2026-01-31
-
-# Search by size range (GB)
-dbbackup catalog search --min-size 0.5 --max-size 5.0
-
-# Search by backup type
-dbbackup catalog search --backup-type incremental
-
-# Search by encryption status
-dbbackup catalog search --encrypted
-
-# Search by verification status
-dbbackup catalog search --verified
-
-# Combine filters
-dbbackup catalog search --database myapp --encrypted --after 2026-01-01
-```
-
-## Backup Details
-
-```bash
-# Show full details for a specific backup
-dbbackup catalog info mydb_2026-01-23.dump.gz
-
-# Output includes:
-#   - Filename and path
-#   - Database name and version
-#   - Backup timestamp
-#   - Backup type (full/incremental/pitr_base)
-#   - Size (compressed/uncompressed)
-#   - Compression ratio
-#   - Encryption (algorithm, key hash)
-#   - Checksums (md5, sha256)
-#   - Verification status and date
-#   - Retention classification (daily/weekly/monthly)
-#   - Comments/notes
-```
-
-## Retention Classification
-
-The catalog classifies backups according to retention policies.
-
-### GFS (Grandfather-Father-Son) Classification
-
-```
-Daily:   Last 7 backups
-Weekly:  One backup per week for 4 weeks
-Monthly: One backup per month for 12 months
-```
-
-Example:
-```bash
-dbbackup catalog list --show-retention
-
-# Output shows:
-# myapp_2026-01-23.dump.gz  daily    (retain 6 more days)
-# myapp_2026-01-16.dump.gz  weekly   (retain 3 more weeks)
-# myapp_2026-01-01.dump.gz  monthly  (retain 11 more months)
-```
-
-## Compliance Reports
-
-Generate compliance reports based on catalog data.
-
-```bash
-# Backup compliance report
-dbbackup catalog compliance-report
-
-# Shows:
-# - All backups compliant with retention policy
-# - Gaps exceeding SLA
-# - Failed backups
-# - Unverified backups
-# - Encryption status
-```
-
-## Configuration
-
-Catalog settings in `.dbbackup.conf`:
-
-```ini
-[catalog]
-# Enable catalog (default: true)
-enabled = true
-
-# Catalog database path (default: ~/.dbbackup/catalog.db)
-db_path = /var/lib/dbbackup/catalog.db
-
-# Retention days (default: 30)
-retention_days = 30
-
-# Minimum backups to keep (default: 5)
-min_backups = 5
-
-# Enable gap detection (default: true)
-gap_detection = true
-
-# Gap alert threshold (hours, default: 36)
-gap_threshold_hours = 36
-
-# Verify backups automatically (default: true)
-auto_verify = true
-```
-
-## Maintenance
-
-### Rebuild Catalog
-
-Rebuild from scratch (useful if corrupted):
-
-```bash
-dbbackup catalog rebuild /mnt/backups/databases
-```
-
-### Export Catalog
-
-Export to CSV for analysis in spreadsheet/BI tools:
-
-```bash
-dbbackup catalog export --format csv --output catalog.csv
-```
-
-Supported formats:
-- csv (Excel compatible)
-- json (structured data)
-- html (browseable report)
-
-### Cleanup Orphaned Entries
-
-Remove catalog entries for deleted backups:
-
-```bash
-dbbackup catalog cleanup --orphaned
-
-# Dry-run
-dbbackup catalog cleanup --orphaned --dry-run
-```
-
-## Examples
-
-### Find All Encrypted Backups from Last Week
-
-```bash
-dbbackup catalog search \
-  --after "$(date -d '7 days ago' +%Y-%m-%d)" \
-  --encrypted
-```
-
-### Generate Weekly Compliance Report
-
-```bash
-dbbackup catalog search \
-  --after "$(date -d '7 days ago' +%Y-%m-%d)" \
-  --show-retention \
-  --verified
-```
-
-### Monitor Backup Size Growth
-
-```bash
-dbbackup catalog stats | grep "Average backup size"
-
-# Track over time
-for week in $(seq 1 4); do
-  DATE=$(date -d "$((week*7)) days ago" +%Y-%m-%d)
-  echo "Week of $DATE:"
-  dbbackup catalog stats --after "$DATE" | grep "Average backup size"
-done
-```
-
-## Troubleshooting
-
-### Catalog Shows Wrong Count
-
-Resync the catalog:
-```bash
-dbbackup catalog sync /mnt/backups/databases --force
-```
-
-### Gaps Detected But Backups Exist
-
-Manual backups not in catalog - sync them:
-```bash
-dbbackup catalog sync /mnt/backups/databases
-```
-
-### Corruption Error
-
-Rebuild catalog:
-```bash
-dbbackup catalog rebuild /mnt/backups/databases
-```

docs/DRILL.md

@@ -1,365 +0,0 @@
-# Disaster Recovery Drilling
-
-Complete guide for automated disaster recovery testing with dbbackup.
-
-## Overview
-
-DR drills automate the process of validating backup integrity through actual restore testing. Instead of hoping backups work when needed, automated drills regularly restore backups in isolated containers to verify:
-
-- Backup file integrity
-- Database compatibility
-- Restore time estimates (RTO)
-- Schema validation
-- Data consistency
-
-## Quick Start
-
-```bash
-# Run single DR drill on latest backup
-dbbackup drill /mnt/backups/databases
-
-# Drill specific database
-dbbackup drill /mnt/backups/databases --database myapp
-
-# Drill multiple databases
-dbbackup drill /mnt/backups/databases --database myapp,mydb
-
-# Schedule daily drills
-dbbackup drill /mnt/backups/databases --schedule daily
-```
-
-## How It Works
-
-1. **Select backup** - Picks latest or specified backup
-2. **Create container** - Starts isolated database container
-3. **Extract backup** - Decompresses to temporary storage
-4. **Restore** - Imports data to test database
-5. **Validate** - Runs integrity checks
-6. **Cleanup** - Removes test container
-7. **Report** - Stores results in catalog
-
-## Drill Configuration
-
-### Select Specific Backup
-
-```bash
-# Latest backup for database
-dbbackup drill /mnt/backups/databases --database myapp
-
-# Backup from specific date
-dbbackup drill /mnt/backups/databases --database myapp --date 2026-01-23
-
-# Oldest backup (best test)
-dbbackup drill /mnt/backups/databases --database myapp --oldest
-```
-
-### Drill Options
-
-```bash
-# Full validation (slower)
-dbbackup drill /mnt/backups/databases --full-validation
-
-# Quick validation (schema only, faster)
-dbbackup drill /mnt/backups/databases --quick-validation
-
-# Store results in catalog
-dbbackup drill /mnt/backups/databases --catalog
-
-# Send notification on failure
-dbbackup drill /mnt/backups/databases --notify-on-failure
-
-# Custom test database name
-dbbackup drill /mnt/backups/databases --test-database dr_test_prod
-```
-
-## Scheduled Drills
-
-Run drills automatically on a schedule.
-
-### Configure Schedule
-
-```bash
-# Daily drill at 03:00
-dbbackup drill /mnt/backups/databases --schedule "03:00"
-
-# Weekly drill (Sunday 02:00)
-dbbackup drill /mnt/backups/databases --schedule "sun 02:00"
-
-# Monthly drill (1st of month)
-dbbackup drill /mnt/backups/databases --schedule "monthly"
-
-# Install as systemd timer
-sudo dbbackup install drill \
-  --backup-path /mnt/backups/databases \
-  --schedule "03:00"
-```
-
-### Verify Schedule
-
-```bash
-# Show next 5 scheduled drills
-dbbackup drill list --upcoming
-
-# Check drill history
-dbbackup drill list --history
-
-# Show drill statistics
-dbbackup drill stats
-```
-
-## Drill Results
-
-### View Drill History
-
-```bash
-# All drill results
-dbbackup drill list
-
-# Recent 10 drills
-dbbackup drill list --limit 10
-
-# Drills from last week
-dbbackup drill list --after "$(date -d '7 days ago' +%Y-%m-%d)"
-
-# Failed drills only
-dbbackup drill list --status failed
-
-# Passed drills only
-dbbackup drill list --status passed
-```
-
-### Detailed Drill Report
-
-```bash
-dbbackup drill report myapp_2026-01-23.dump.gz
-
-# Output includes:
-#   - Backup filename
-#   - Database version
-#   - Extract time
-#   - Restore time
-#   - Row counts (before/after)
-#   - Table verification results
-#   - Data integrity status
-#   - Pass/Fail verdict
-#   - Warnings/errors
-```
-
-## Validation Types
-
-### Full Validation
-
-Deep integrity checks on restored data.
-
-```bash
-dbbackup drill /mnt/backups/databases --full-validation
-
-# Checks:
-# - All tables restored
-# - Row counts match original
-# - Indexes present and valid
-# - Constraints enforced
-# - Foreign key references valid
-# - Sequence values correct (PostgreSQL)
-# - Triggers present (if not system-generated)
-```
-
-### Quick Validation
-
-Schema-only validation (fast).
-
-```bash
-dbbackup drill /mnt/backups/databases --quick-validation
-
-# Checks:
-# - Database connects
-# - All tables present
-# - Column definitions correct
-# - Indexes exist
-```
-
-### Custom Validation
-
-Run custom SQL checks.
-
-```bash
-# Add custom validation query
-dbbackup drill /mnt/backups/databases \
-  --validation-query "SELECT COUNT(*) FROM users" \
-  --validation-expected 15000
-
-# Example for multiple tables
-dbbackup drill /mnt/backups/databases \
-  --validation-query "SELECT COUNT(*) FROM orders WHERE status='completed'" \
-  --validation-expected 42000
-```
-
-## Reporting
-
-### Generate Drill Report
-
-```bash
-# HTML report (email-friendly)
-dbbackup drill report --format html --output drill-report.html
-
-# JSON report (for CI/CD pipelines)
-dbbackup drill report --format json --output drill-results.json
-
-# Markdown report (GitHub integration)
-dbbackup drill report --format markdown --output drill-results.md
-```
-
-### Example Report Format
-
-```
-Disaster Recovery Drill Results
-================================
-
-Backup: myapp_2026-01-23_14-30-00.dump.gz
-Date: 2026-01-25 03:15:00
-Duration: 5m 32s
-Status: PASSED
-
-Details:
-  Extract Time:        1m 15s
-  Restore Time:        3m 42s
-  Validation Time:     34s
-  
-  Tables Restored:     42
-  Rows Verified:       1,234,567
-  Total Size:          2.5 GB
-  
-Validation:
-  Schema Check:        OK
-  Row Count Check:     OK (all tables)
-  Index Check:         OK (all 28 indexes present)
-  Constraint Check:    OK (all 5 foreign keys valid)
-  
-Warnings: None
-Errors: None
-```
-
-## Integration with CI/CD
-
-### GitHub Actions
-
-```yaml
-name: Daily DR Drill
-
-on:
-  schedule:
-    - cron: '0 3 * * *'  # Daily at 03:00
-
-jobs:
-  dr-drill:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Run DR drill
-        run: |
-          dbbackup drill /backups/databases \
-            --full-validation \
-            --format json \
-            --output results.json
-      
-      - name: Check results
-        run: |
-          if grep -q '"status":"failed"' results.json; then
-            echo "DR drill failed!"
-            exit 1
-          fi
-      
-      - name: Upload report
-        uses: actions/upload-artifact@v2
-        with:
-          name: drill-results
-          path: results.json
-```
-
-### Jenkins Pipeline
-
-```groovy
-pipeline {
-  triggers {
-    cron('H 3 * * *')  // Daily at 03:00
-  }
-  
-  stages {
-    stage('DR Drill') {
-      steps {
-        sh 'dbbackup drill /backups/databases --full-validation --format json --output drill.json'
-      }
-    }
-    
-    stage('Validate Results') {
-      steps {
-        script {
-          def results = readJSON file: 'drill.json'
-          if (results.status != 'passed') {
-            error("DR drill failed!")
-          }
-        }
-      }
-    }
-  }
-}
-```
-
-## Troubleshooting
-
-### Drill Fails with "Out of Space"
-
-```bash
-# Check available disk space
-df -h
-
-# Clean up old test databases
-docker system prune -a
-
-# Use faster storage for test
-dbbackup drill /mnt/backups/databases --temp-dir /ssd/drill-temp
-```
-
-### Drill Times Out
-
-```bash
-# Increase timeout (minutes)
-dbbackup drill /mnt/backups/databases --timeout 30
-
-# Skip certain validations to speed up
-dbbackup drill /mnt/backups/databases --quick-validation
-```
-
-### Drill Shows Data Mismatch
-
-Indicates a problem with the backup - investigate immediately:
-
-```bash
-# Get detailed diff report
-dbbackup drill report --show-diffs myapp_2026-01-23.dump.gz
-
-# Regenerate backup
-dbbackup backup single myapp --force-full
-```
-
-## Best Practices
-
-1. **Run weekly drills minimum** - Catch issues early
-
-2. **Test oldest backups** - Verify full retention chain works
-   ```bash
-   dbbackup drill /mnt/backups/databases --oldest
-   ```
-
-3. **Test critical databases first** - Prioritize by impact
-
-4. **Store results in catalog** - Track historical pass/fail rates
-
-5. **Alert on failures** - Automatic notification via email/Slack
-
-6. **Document RTO** - Use drill times to refine recovery objectives
-
-7. **Test cross-major-versions** - Use test environment with different DB version
-   ```bash
-   # Test PostgreSQL 15 backup on PostgreSQL 16
-   dbbackup drill /mnt/backups/databases --target-version 16
-   ```

docs/EXPORTER.md

@@ -1,537 +0,0 @@
-# DBBackup Prometheus Exporter & Grafana Dashboard
-
-This document provides complete reference for the DBBackup Prometheus exporter, including all exported metrics, setup instructions, and Grafana dashboard configuration.
-
-## What's New (January 2026)
-
-### New Features
-- **Backup Type Tracking**: All backup metrics now include a `backup_type` label (`full`, `incremental`, or `pitr_base` for PITR base backups)
-  - **Note**: CLI `--backup-type` flag only accepts `full` or `incremental`. The `pitr_base` label is auto-assigned when using `dbbackup pitr base`
-- **PITR Metrics**: Complete Point-in-Time Recovery monitoring for PostgreSQL WAL and MySQL binlog archiving
-- **New Alerts**: PITR-specific alerts for archive lag, chain integrity, and gap detection
-
-### New Metrics Added
-| Metric | Description |
-|--------|-------------|
-| `dbbackup_build_info` | Build info with version and commit labels |
-| `dbbackup_backup_by_type` | Count backups by type (full/incremental/pitr_base) |
-| `dbbackup_pitr_enabled` | Whether PITR is enabled (1/0) |
-| `dbbackup_pitr_archive_lag_seconds` | Seconds since last WAL/binlog archived |
-| `dbbackup_pitr_chain_valid` | WAL/binlog chain integrity (1=valid) |
-| `dbbackup_pitr_gap_count` | Number of gaps in archive chain |
-| `dbbackup_pitr_archive_count` | Total archived segments |
-| `dbbackup_pitr_archive_size_bytes` | Total archive storage |
-| `dbbackup_pitr_recovery_window_minutes` | Estimated PITR coverage |
-
-### Label Changes
-- `backup_type` label added to: `dbbackup_rpo_seconds`, `dbbackup_last_success_timestamp`, `dbbackup_last_backup_duration_seconds`, `dbbackup_last_backup_size_bytes`
-- `dbbackup_backup_total` type changed from counter to gauge (more accurate for snapshot-based collection)
-
----
-
-## Table of Contents
-
-- [Quick Start](#quick-start)
-- [Exporter Modes](#exporter-modes)
-- [Complete Metrics Reference](#complete-metrics-reference)
-- [Grafana Dashboard Setup](#grafana-dashboard-setup)
-- [Alerting Rules](#alerting-rules)
-- [Troubleshooting](#troubleshooting)
-
----
-
-## Quick Start
-
-### Start the Metrics Server
-
-```bash
-# Start HTTP exporter on default port 9399 (auto-detects hostname for server label)
-dbbackup metrics serve
-
-# Custom port
-dbbackup metrics serve --port 9100
-
-# Specify server name for labels (overrides auto-detection)
-dbbackup metrics serve --server production-db-01
-
-# Specify custom catalog database location
-dbbackup metrics serve --catalog-db /path/to/catalog.db
-```
-
-### Export to Textfile (for node_exporter)
-
-```bash
-# Export to default location
-dbbackup metrics export
-
-# Custom output path
-dbbackup metrics export --output /var/lib/node_exporter/textfile_collector/dbbackup.prom
-
-# Specify catalog database and server name
-dbbackup metrics export --catalog-db /root/.dbbackup/catalog.db --server myhost
-```
-
-### Install as Systemd Service
-
-```bash
-# Install with metrics exporter
-sudo dbbackup install --with-metrics
-
-# Start the service
-sudo systemctl start dbbackup-exporter
-```
-
----
-
-## Exporter Modes
-
-### HTTP Server Mode (`metrics serve`)
-
-Runs a standalone HTTP server exposing metrics for direct Prometheus scraping.
-
-| Endpoint    | Description                      |
-|-------------|----------------------------------|
-| `/metrics`  | Prometheus metrics               |
-| `/health`   | Health check (returns 200 OK)    |
-| `/`         | Service info page                |
-
-**Default Port:** 9399
-
-**Server Label:** Auto-detected from hostname (use `--server` to override)
-
-**Catalog Location:** `~/.dbbackup/catalog.db` (use `--catalog-db` to override)
-
-**Configuration:**
-```bash
-dbbackup metrics serve [--server <instance-name>] [--port <port>] [--catalog-db <path>]
-```
-
-| Flag | Default | Description |
-|------|---------|-------------|
-| `--server` | hostname | Server label for metrics (auto-detected if not set) |
-| `--port` | 9399 | HTTP server port |
-| `--catalog-db` | ~/.dbbackup/catalog.db | Path to catalog SQLite database |
-
-### Textfile Mode (`metrics export`)
-
-Writes metrics to a file for collection by node_exporter's textfile collector.
-
-**Default Path:** `/var/lib/dbbackup/metrics/dbbackup.prom`
-
-| Flag | Default | Description |
-|------|---------|-------------|
-| `--server` | hostname | Server label for metrics (auto-detected if not set) |
-| `--output` | /var/lib/dbbackup/metrics/dbbackup.prom | Output file path |
-| `--catalog-db` | ~/.dbbackup/catalog.db | Path to catalog SQLite database |
-
-**node_exporter Configuration:**
-```bash
-node_exporter --collector.textfile.directory=/var/lib/dbbackup/metrics/
-```
-
----
-
-## Complete Metrics Reference
-
-All metrics use the `dbbackup_` prefix. Below is the **validated** list of metrics exported by DBBackup.
-
-### Backup Status Metrics
-
-| Metric Name | Type | Labels | Description |
-|-------------|------|--------|-------------|
-| `dbbackup_last_success_timestamp` | gauge | `server`, `database`, `engine`, `backup_type` | Unix timestamp of last successful backup |
-| `dbbackup_last_backup_duration_seconds` | gauge | `server`, `database`, `engine`, `backup_type` | Duration of last successful backup in seconds |
-| `dbbackup_last_backup_size_bytes` | gauge | `server`, `database`, `engine`, `backup_type` | Size of last successful backup in bytes |
-| `dbbackup_backup_total` | gauge | `server`, `database`, `status` | Total backup attempts (status: `success` or `failure`) |
-| `dbbackup_backup_by_type` | gauge | `server`, `database`, `backup_type` | Backup count by type (`full`, `incremental`, `pitr_base`) |
-| `dbbackup_rpo_seconds` | gauge | `server`, `database`, `backup_type` | Seconds since last successful backup (RPO) |
-| `dbbackup_backup_verified` | gauge | `server`, `database` | Whether last backup was verified (1=yes, 0=no) |
-| `dbbackup_scrape_timestamp` | gauge | `server` | Unix timestamp when metrics were collected |
-
-### PITR (Point-in-Time Recovery) Metrics
-
-| Metric Name | Type | Labels | Description |
-|-------------|------|--------|-------------|
-| `dbbackup_pitr_enabled` | gauge | `server`, `database`, `engine` | Whether PITR is enabled (1=yes, 0=no) |
-| `dbbackup_pitr_last_archived_timestamp` | gauge | `server`, `database`, `engine` | Unix timestamp of last archived WAL/binlog |
-| `dbbackup_pitr_archive_lag_seconds` | gauge | `server`, `database`, `engine` | Seconds since last archive (lower is better) |
-| `dbbackup_pitr_archive_count` | gauge | `server`, `database`, `engine` | Total archived WAL segments or binlog files |
-| `dbbackup_pitr_archive_size_bytes` | gauge | `server`, `database`, `engine` | Total size of archived logs in bytes |
-| `dbbackup_pitr_chain_valid` | gauge | `server`, `database`, `engine` | Whether archive chain is valid (1=yes, 0=gaps) |
-| `dbbackup_pitr_gap_count` | gauge | `server`, `database`, `engine` | Number of gaps in archive chain |
-| `dbbackup_pitr_recovery_window_minutes` | gauge | `server`, `database`, `engine` | Estimated PITR coverage window in minutes |
-| `dbbackup_pitr_scrape_timestamp` | gauge | `server` | PITR metrics collection timestamp |
-
-### Deduplication Metrics
-
-| Metric Name | Type | Labels | Description |
-|-------------|------|--------|-------------|
-| `dbbackup_dedup_chunks_total` | gauge | `server` | Total unique chunks stored |
-| `dbbackup_dedup_manifests_total` | gauge | `server` | Total number of deduplicated backups |
-| `dbbackup_dedup_backup_bytes_total` | gauge | `server` | Total logical size of all backups (bytes) |
-| `dbbackup_dedup_stored_bytes_total` | gauge | `server` | Total unique data stored after dedup (bytes) |
-| `dbbackup_dedup_space_saved_bytes` | gauge | `server` | Bytes saved by deduplication |
-| `dbbackup_dedup_ratio` | gauge | `server` | Dedup efficiency (0-1, higher = better) |
-| `dbbackup_dedup_disk_usage_bytes` | gauge | `server` | Actual disk usage of chunk store |
-| `dbbackup_dedup_compression_ratio` | gauge | `server` | Compression ratio (0-1, higher = better) |
-| `dbbackup_dedup_oldest_chunk_timestamp` | gauge | `server` | Unix timestamp of oldest chunk |
-| `dbbackup_dedup_newest_chunk_timestamp` | gauge | `server` | Unix timestamp of newest chunk |
-| `dbbackup_dedup_scrape_timestamp` | gauge | `server` | Dedup metrics collection timestamp |
-
-### Per-Database Dedup Metrics
-
-| Metric Name | Type | Labels | Description |
-|-------------|------|--------|-------------|
-| `dbbackup_dedup_database_backup_count` | gauge | `server`, `database` | Deduplicated backups per database |
-| `dbbackup_dedup_database_ratio` | gauge | `server`, `database` | Per-database dedup ratio |
-| `dbbackup_dedup_database_last_backup_timestamp` | gauge | `server`, `database` | Last backup timestamp per database |
-| `dbbackup_dedup_database_total_bytes` | gauge | `server`, `database` | Total logical size per database |
-| `dbbackup_dedup_database_stored_bytes` | gauge | `server`, `database` | Stored bytes per database (after dedup) |
-| `dbbackup_rpo_seconds` | gauge | `server`, `database` | Seconds since last backup (same as regular backups for unified alerting) |
-
-> **Note:** The `dbbackup_rpo_seconds` metric is exported by both regular backups and dedup backups, enabling unified alerting without complex PromQL expressions.
-
----
-
-## Example Metrics Output
-
-```prometheus
-# DBBackup Prometheus Metrics
-# Generated at: 2026-01-27T10:30:00Z
-# Server: production
-
-# HELP dbbackup_last_success_timestamp Unix timestamp of last successful backup
-# TYPE dbbackup_last_success_timestamp gauge
-dbbackup_last_success_timestamp{server="production",database="myapp",engine="postgres",backup_type="full"} 1737884600
-
-# HELP dbbackup_last_backup_duration_seconds Duration of last successful backup in seconds
-# TYPE dbbackup_last_backup_duration_seconds gauge
-dbbackup_last_backup_duration_seconds{server="production",database="myapp",engine="postgres",backup_type="full"} 125.50
-
-# HELP dbbackup_last_backup_size_bytes Size of last successful backup in bytes
-# TYPE dbbackup_last_backup_size_bytes gauge
-dbbackup_last_backup_size_bytes{server="production",database="myapp",engine="postgres",backup_type="full"} 1073741824
-
-# HELP dbbackup_backup_total Total number of backup attempts by type and status
-# TYPE dbbackup_backup_total gauge
-dbbackup_backup_total{server="production",database="myapp",status="success"} 42
-dbbackup_backup_total{server="production",database="myapp",status="failure"} 2
-
-# HELP dbbackup_backup_by_type Total number of backups by backup type
-# TYPE dbbackup_backup_by_type gauge
-dbbackup_backup_by_type{server="production",database="myapp",backup_type="full"} 30
-dbbackup_backup_by_type{server="production",database="myapp",backup_type="incremental"} 12
-
-# HELP dbbackup_rpo_seconds Recovery Point Objective - seconds since last successful backup
-# TYPE dbbackup_rpo_seconds gauge
-dbbackup_rpo_seconds{server="production",database="myapp",backup_type="full"} 3600
-
-# HELP dbbackup_backup_verified Whether the last backup was verified (1=yes, 0=no)
-# TYPE dbbackup_backup_verified gauge
-dbbackup_backup_verified{server="production",database="myapp"} 1
-
-# HELP dbbackup_pitr_enabled Whether PITR is enabled for database (1=enabled, 0=disabled)
-# TYPE dbbackup_pitr_enabled gauge
-dbbackup_pitr_enabled{server="production",database="myapp",engine="postgres"} 1
-
-# HELP dbbackup_pitr_archive_lag_seconds Seconds since last WAL/binlog was archived
-# TYPE dbbackup_pitr_archive_lag_seconds gauge
-dbbackup_pitr_archive_lag_seconds{server="production",database="myapp",engine="postgres"} 45
-
-# HELP dbbackup_pitr_chain_valid Whether the WAL/binlog chain is valid (1=valid, 0=gaps detected)
-# TYPE dbbackup_pitr_chain_valid gauge
-dbbackup_pitr_chain_valid{server="production",database="myapp",engine="postgres"} 1
-
-# HELP dbbackup_pitr_recovery_window_minutes Estimated recovery window in minutes
-# TYPE dbbackup_pitr_recovery_window_minutes gauge
-dbbackup_pitr_recovery_window_minutes{server="production",database="myapp",engine="postgres"} 10080
-
-# HELP dbbackup_dedup_ratio Deduplication ratio (0-1, higher is better)
-# TYPE dbbackup_dedup_ratio gauge
-dbbackup_dedup_ratio{server="production"} 0.6500
-
-# HELP dbbackup_dedup_space_saved_bytes Bytes saved by deduplication
-# TYPE dbbackup_dedup_space_saved_bytes gauge
-dbbackup_dedup_space_saved_bytes{server="production"} 5368709120
-```
-
----
-
-## Prometheus Scrape Configuration
-
-Add to your `prometheus.yml`:
-
-```yaml
-scrape_configs:
-  - job_name: 'dbbackup'
-    scrape_interval: 60s
-    scrape_timeout: 10s
-    
-    static_configs:
-      - targets:
-          - 'db-server-01:9399'
-          - 'db-server-02:9399'
-        labels:
-          environment: 'production'
-      
-      - targets:
-          - 'db-staging:9399'
-        labels:
-          environment: 'staging'
-    
-    relabel_configs:
-      - source_labels: [__address__]
-        target_label: instance
-        regex: '([^:]+):\d+'
-        replacement: '$1'
-```
-
-### File-based Service Discovery
-
-```yaml
-  - job_name: 'dbbackup-sd'
-    scrape_interval: 60s
-    file_sd_configs:
-      - files:
-          - '/etc/prometheus/targets/dbbackup/*.yml'
-        refresh_interval: 5m
-```
-
----
-
-## Grafana Dashboard Setup
-
-### Import Dashboard
-
-1. Open Grafana → **Dashboards** → **Import**
-2. Upload `grafana/dbbackup-dashboard.json` or paste the JSON
-3. Select your Prometheus data source
-4. Click **Import**
-
-### Dashboard Panels
-
-The dashboard includes the following panels:
-
-#### Backup Overview Row
-| Panel | Metric Used | Description |
-|-------|-------------|-------------|
-| Last Backup Status | `dbbackup_rpo_seconds < bool 604800` | SUCCESS/FAILED indicator |
-| Time Since Last Backup | `dbbackup_rpo_seconds` | Time elapsed since last backup |
-| Verification Status | `dbbackup_backup_verified` | VERIFIED/NOT VERIFIED |
-| Total Successful Backups | `dbbackup_backup_total{status="success"}` | Counter |
-| Total Failed Backups | `dbbackup_backup_total{status="failure"}` | Counter |
-| RPO Over Time | `dbbackup_rpo_seconds` | Time series graph |
-| Backup Size | `dbbackup_last_backup_size_bytes` | Bar chart |
-| Backup Duration | `dbbackup_last_backup_duration_seconds` | Time series |
-| Backup Status Overview | Multiple metrics | Table with color-coded status |
-
-#### Deduplication Statistics Row
-| Panel | Metric Used | Description |
-|-------|-------------|-------------|
-| Dedup Ratio | `dbbackup_dedup_ratio` | Percentage efficiency |
-| Space Saved | `dbbackup_dedup_space_saved_bytes` | Total bytes saved |
-| Disk Usage | `dbbackup_dedup_disk_usage_bytes` | Actual storage used |
-| Total Chunks | `dbbackup_dedup_chunks_total` | Chunk count |
-| Compression Ratio | `dbbackup_dedup_compression_ratio` | Compression efficiency |
-| Oldest Chunk | `dbbackup_dedup_oldest_chunk_timestamp` | Age of oldest data |
-| Newest Chunk | `dbbackup_dedup_newest_chunk_timestamp` | Most recent chunk |
-| Dedup Ratio by Database | `dbbackup_dedup_database_ratio` | Per-database efficiency |
-| Dedup Storage Over Time | `dbbackup_dedup_space_saved_bytes`, `dbbackup_dedup_disk_usage_bytes` | Storage trends |
-
-### Dashboard Variables
-
-| Variable | Query | Description |
-|----------|-------|-------------|
-| `$server` | `label_values(dbbackup_rpo_seconds, server)` | Filter by server |
-| `$DS_PROMETHEUS` | datasource | Prometheus data source |
-
-### Dashboard Thresholds
-
-#### RPO Thresholds
-- **Green:** < 12 hours (43200 seconds)
-- **Yellow:** 12-24 hours
-- **Red:** > 24 hours (86400 seconds)
-
-#### Backup Status Thresholds
-- **1 (Green):** SUCCESS
-- **0 (Red):** FAILED
-
----
-
-## Alerting Rules
-
-### Pre-configured Alerts
-
-Import `deploy/prometheus/alerting-rules.yaml` into Prometheus/Alertmanager.
-
-#### Backup Status Alerts
-| Alert | Expression | Severity | Description |
-|-------|------------|----------|-------------|
-| `DBBackupRPOWarning` | `dbbackup_rpo_seconds > 43200` | warning | No backup for 12+ hours |
-| `DBBackupRPOCritical` | `dbbackup_rpo_seconds > 86400` | critical | No backup for 24+ hours |
-| `DBBackupFailed` | `increase(dbbackup_backup_total{status="failure"}[1h]) > 0` | critical | Backup failed |
-| `DBBackupFailureRateHigh` | Failure rate > 10% in 24h | warning | High failure rate |
-| `DBBackupSizeAnomaly` | Size changed > 50% vs 7-day avg | warning | Unusual backup size |
-| `DBBackupSizeZero` | `dbbackup_last_backup_size_bytes == 0` | critical | Empty backup file |
-| `DBBackupDurationHigh` | `dbbackup_last_backup_duration_seconds > 3600` | warning | Backup taking > 1 hour |
-| `DBBackupNotVerified` | `dbbackup_backup_verified == 0` for 24h | warning | Backup not verified |
-| `DBBackupNoRecentFull` | No full backup in 7+ days | warning | Need full backup for incremental chain |
-
-#### PITR Alerts (New)
-| Alert | Expression | Severity | Description |
-|-------|------------|----------|-------------|
-| `DBBackupPITRArchiveLag` | `dbbackup_pitr_archive_lag_seconds > 600` | warning | Archive 10+ min behind |
-| `DBBackupPITRArchiveCritical` | `dbbackup_pitr_archive_lag_seconds > 1800` | critical | Archive 30+ min behind |
-| `DBBackupPITRChainBroken` | `dbbackup_pitr_chain_valid == 0` | critical | Gaps in WAL/binlog chain |
-| `DBBackupPITRGaps` | `dbbackup_pitr_gap_count > 0` | warning | Gaps detected in archive chain |
-| `DBBackupPITRDisabled` | PITR unexpectedly disabled | critical | PITR was enabled but now off |
-
-#### Infrastructure Alerts
-| Alert | Expression | Severity | Description |
-|-------|------------|----------|-------------|
-| `DBBackupExporterDown` | `up{job="dbbackup"} == 0` | critical | Exporter unreachable |
-| `DBBackupDedupRatioLow` | `dbbackup_dedup_ratio < 0.2` for 24h | info | Low dedup efficiency |
-| `DBBackupStorageHigh` | `dbbackup_dedup_disk_usage_bytes > 1TB` | warning | High storage usage |
-
-### Example Alert Configuration
-
-```yaml
-groups:
-  - name: dbbackup
-    rules:
-      - alert: DBBackupRPOCritical
-        expr: dbbackup_rpo_seconds > 86400
-        for: 5m
-        labels:
-          severity: critical
-        annotations:
-          summary: "No backup for {{ $labels.database }} in 24+ hours"
-          description: "RPO violation on {{ $labels.server }}. Last backup: {{ $value | humanizeDuration }} ago."
-      
-      - alert: DBBackupPITRChainBroken
-        expr: dbbackup_pitr_chain_valid == 0
-        for: 1m
-        labels:
-          severity: critical
-        annotations:
-          summary: "PITR chain broken for {{ $labels.database }}"
-          description: "WAL/binlog chain has gaps. Point-in-time recovery is NOT possible. New base backup required."
-```
-
----
-
-## Troubleshooting
-
-### Exporter Not Returning Metrics
-
-1. **Check catalog access:**
-   ```bash
-   dbbackup catalog list
-   ```
-
-2. **Verify port is open:**
-   ```bash
-   curl -v http://localhost:9399/metrics
-   ```
-
-3. **Check logs:**
-   ```bash
-   journalctl -u dbbackup-exporter -f
-   ```
-
-### Missing Dedup Metrics
-
-Dedup metrics are only exported when using deduplication:
-```bash
-# Ensure dedup is enabled
-dbbackup dedup status
-```
-
-### Metrics Not Updating
-
-The exporter caches metrics for 30 seconds. The `/health` endpoint can confirm the exporter is running.
-
-### Stale or Empty Metrics (Catalog Location Mismatch)
-
-If the exporter shows stale or no backup data, verify the catalog database location:
-
-```bash
-# Check where catalog sync writes
-dbbackup catalog sync /path/to/backups
-# Output shows: [STATS] Catalog database: /root/.dbbackup/catalog.db
-
-# Ensure exporter reads from the same location
-dbbackup metrics serve --catalog-db /root/.dbbackup/catalog.db
-```
-
-**Common Issue:** If backup scripts run as root but the exporter runs as a different user, they may use different catalog locations. Use `--catalog-db` to ensure consistency.
-
-### Dashboard Shows "No Data"
-
-1. Verify Prometheus is scraping successfully:
-   ```bash
-   curl http://prometheus:9090/api/v1/targets | grep dbbackup
-   ```
-
-2. Check metric names match (case-sensitive):
-   ```promql
-   {__name__=~"dbbackup_.*"}
-   ```
-
-3. Verify `server` label matches dashboard variable.
-
-### Label Mismatch Issues
-
-Ensure the `--server` flag matches across all instances:
-```bash
-# Consistent naming (or let it auto-detect from hostname)
-dbbackup metrics serve --server prod-db-01
-```
-
-> **Note:** As of v3.x, the exporter auto-detects hostname if `--server` is not specified. This ensures unique server labels in multi-host deployments.
-
----
-
-## Metrics Validation Checklist
-
-Use this checklist to validate your exporter setup:
-
-- [ ] `/metrics` endpoint returns HTTP 200
-- [ ] `/health` endpoint returns `{"status":"ok"}`
-- [ ] `dbbackup_rpo_seconds` shows correct RPO values
-- [ ] `dbbackup_backup_total` increments after backups
-- [ ] `dbbackup_backup_verified` reflects verification status
-- [ ] `dbbackup_last_backup_size_bytes` matches actual backup sizes
-- [ ] Prometheus scrape succeeds (check targets page)
-- [ ] Grafana dashboard loads without errors
-- [ ] Dashboard variables populate correctly
-- [ ] All panels show data (no "No Data" messages)
-
----
-
-## Files Reference
-
-| File | Description |
-|------|-------------|
-| `grafana/dbbackup-dashboard.json` | Grafana dashboard JSON |
-| `grafana/alerting-rules.yaml` | Grafana alerting rules |
-| `deploy/prometheus/alerting-rules.yaml` | Prometheus alerting rules |
-| `deploy/prometheus/scrape-config.yaml` | Prometheus scrape configuration |
-| `docs/METRICS.md` | Metrics documentation |
-
----
-
-## Version Compatibility
-
-| DBBackup Version | Metrics Version | Dashboard UID |
-|------------------|-----------------|---------------|
-| 1.0.0+           | v1              | `dbbackup-overview` |
-
----
-
-## Support
-
-For issues with the exporter or dashboard:
-1. Check the [troubleshooting section](#troubleshooting)
-2. Review logs: `journalctl -u dbbackup-exporter`
-3. Open an issue with metrics output and dashboard screenshots

docs/LOCK_DEBUGGING.md

@@ -1,266 +0,0 @@
-# Lock Debugging Feature
-
-## Overview
-
-The `--debug-locks` flag provides complete visibility into the lock protection system introduced in v3.42.82. This eliminates the need for blind troubleshooting when diagnosing lock exhaustion issues.
-
-## Problem
-
-When PostgreSQL lock exhaustion occurs during restore:
-- User sees "out of shared memory" error after 7 hours
-- No visibility into why Large DB Guard chose conservative mode  
-- Unknown whether lock boost attempts succeeded
-- Unclear what actions are required to fix the issue
-- Requires 14 days of troubleshooting to understand the problem
-
-## Solution
-
-New `--debug-locks` flag captures every decision point in the lock protection system with detailed logging prefixed by 🔍 [LOCK-DEBUG].
-
-## Usage
-
-### CLI
-```bash
-# Single database restore with lock debugging
-dbbackup restore single mydb.dump --debug-locks --confirm
-
-# Cluster restore with lock debugging  
-dbbackup restore cluster backup.tar.gz --debug-locks --confirm
-
-# Can also use global flag
-dbbackup --debug-locks restore cluster backup.tar.gz --confirm
-```
-
-### TUI (Interactive Mode)
-```bash
-dbbackup  # Start interactive mode
-# Navigate to restore operation
-# Select your archive
-# Press 'l' to toggle lock debugging (🔍 icon appears when enabled)
-# Press Enter to proceed
-```
-
-## What Gets Logged
-
-### 1. Strategy Analysis Entry Point
-```
-🔍 [LOCK-DEBUG] Large DB Guard: Starting strategy analysis
-    archive=cluster_backup.tar.gz
-    dump_count=15
-```
-
-### 2. PostgreSQL Configuration Detection
-```
-🔍 [LOCK-DEBUG] Querying PostgreSQL for lock configuration
-    host=localhost
-    port=5432
-    user=postgres
-
-🔍 [LOCK-DEBUG] Successfully retrieved PostgreSQL lock settings
-    max_locks_per_transaction=2048
-    max_connections=256
-    total_capacity=524288
-```
-
-### 3. Guard Decision Logic  
-```
-🔍 [LOCK-DEBUG] PostgreSQL lock configuration detected
-    max_locks_per_transaction=2048
-    max_connections=256
-    calculated_capacity=524288
-    threshold_required=4096
-    below_threshold=true
-
-🔍 [LOCK-DEBUG] Guard decision: CONSERVATIVE mode
-    jobs=1
-    parallel_dbs=1
-    reason="Lock threshold not met (max_locks < 4096)"
-```
-
-### 4. Lock Boost Attempts
-```
-🔍 [LOCK-DEBUG] boostPostgreSQLSettings: Starting lock boost procedure
-    target_lock_value=4096
-
-🔍 [LOCK-DEBUG] Current PostgreSQL lock configuration
-    current_max_locks=2048
-    target_max_locks=4096
-    boost_required=true
-
-🔍 [LOCK-DEBUG] Executing ALTER SYSTEM to boost locks
-    from=2048
-    to=4096
-
-🔍 [LOCK-DEBUG] ALTER SYSTEM succeeded - restart required
-    setting_saved_to=postgresql.auto.conf
-    active_after="PostgreSQL restart"
-```
-
-### 5. PostgreSQL Restart Attempts
-```
-🔍 [LOCK-DEBUG] Attempting PostgreSQL restart to activate new lock setting
-
-# If restart succeeds:
-🔍 [LOCK-DEBUG] PostgreSQL restart SUCCEEDED
-
-🔍 [LOCK-DEBUG] Post-restart verification
-    new_max_locks=4096
-    target_was=4096
-    verification=PASS
-
-# If restart fails:
-🔍 [LOCK-DEBUG] PostgreSQL restart FAILED
-    current_locks=2048
-    required_locks=4096
-    setting_saved=true
-    setting_active=false
-    verdict="ABORT - Manual restart required"
-```
-
-### 6. Final Verification
-```
-🔍 [LOCK-DEBUG] Lock boost function returned
-    original_max_locks=2048
-    target_max_locks=4096
-    boost_successful=false
-
-🔍 [LOCK-DEBUG] CRITICAL: Lock verification FAILED
-    actual_locks=2048
-    required_locks=4096
-    delta=2048
-    verdict="ABORT RESTORE"
-```
-
-## Example Workflow
-
-### Scenario: Lock Exhaustion on New System
-
-```bash
-# Step 1: Run restore with lock debugging enabled
-dbbackup restore cluster backup.tar.gz --debug-locks --confirm
-
-# Output shows:
-# 🔍 [LOCK-DEBUG] Guard decision: CONSERVATIVE mode
-#     current_locks=2048, required=4096
-#     verdict="ABORT - Manual restart required"
-
-# Step 2: Follow the actionable instructions
-sudo -u postgres psql -c "ALTER SYSTEM SET max_locks_per_transaction = 4096;"
-sudo systemctl restart postgresql
-
-# Step 3: Verify the change
-sudo -u postgres psql -c "SHOW max_locks_per_transaction;"
-# Output: 4096
-
-# Step 4: Retry restore (can disable debug now)
-dbbackup restore cluster backup.tar.gz --confirm
-
-# Success! Restore proceeds with verified lock protection
-```
-
-## When to Use
-
-### Enable Lock Debugging When:
-- Diagnosing lock exhaustion failures
-- Understanding why conservative mode was triggered
-- Verifying lock boost attempts worked
-- Troubleshooting "out of shared memory" errors  
-- Setting up restore on new systems with unknown lock config
-- Documenting lock requirements for compliance/security
-
-### Leave Disabled For:
-- Normal production restores (cleaner logs)
-- Scripted/automated restores (less noise)
-- When lock config is known to be sufficient
-- When restore performance is critical
-
-## Integration Points
-
-### Configuration
-- **Config Field:** `cfg.DebugLocks` (bool)
-- **CLI Flag:** `--debug-locks` (persistent flag on root command)
-- **TUI Toggle:** Press 'l' in restore preview screen
-- **Default:** `false` (opt-in only)
-
-### Files Modified
-- `internal/config/config.go` - Added DebugLocks field
-- `cmd/root.go` - Added --debug-locks persistent flag
-- `cmd/restore.go` - Wired flag to single/cluster restore commands
-- `internal/restore/large_db_guard.go` - 20+ debug log points
-- `internal/restore/engine.go` - 15+ debug log points in boost logic
-- `internal/tui/restore_preview.go` - 'l' key toggle with 🔍 icon
-
-### Log Locations
-All lock debug logs go to the configured logger (usually syslog or file) with level INFO. The 🔍 [LOCK-DEBUG] prefix makes them easy to grep:
-
-```bash
-# Filter lock debug logs
-journalctl -u dbbackup | grep 'LOCK-DEBUG'
-
-# Or in log files
-grep 'LOCK-DEBUG' /var/log/dbbackup.log
-```
-
-## Backward Compatibility
-
-- ✅ No breaking changes
-- ✅ Flag defaults to false (no output unless enabled)
-- ✅ Existing scripts continue to work unchanged
-- ✅ TUI users get new 'l' toggle automatically
-- ✅ CLI users can add --debug-locks when needed
-
-## Performance Impact
-
-Negligible - the debug logging only adds:
-- ~5 database queries (SHOW commands)
-- ~10 conditional if statements checking cfg.DebugLocks
-- ~50KB of additional log output when enabled
-- No impact on restore performance itself
-
-## Relationship to v3.42.82
-
-This feature completes the lock protection system:
-
-**v3.42.82 (Protection):**
-- Fixed Guard to always force conservative mode if max_locks < 4096
-- Fixed engine to abort restore if lock boost fails  
-- Ensures no path allows 7-hour failures
-
-**v3.42.83 (Visibility):**
-- Shows why Guard chose conservative mode
-- Displays lock config that was detected
-- Tracks boost attempts and outcomes
-- Explains why restore was aborted
-
-Together: Bulletproof protection + complete transparency.
-
-## Deployment
-
-1. Update to v3.42.83:
-   ```bash
-   wget https://github.com/PlusOne/dbbackup/releases/download/v3.42.83/dbbackup_linux_amd64
-   chmod +x dbbackup_linux_amd64
-   sudo mv dbbackup_linux_amd64 /usr/local/bin/dbbackup
-   ```
-
-2. Test lock debugging:
-   ```bash
-   dbbackup restore cluster test_backup.tar.gz --debug-locks --dry-run
-   ```
-
-3. Enable for production if diagnosing issues:
-   ```bash
-   dbbackup restore cluster production_backup.tar.gz --debug-locks --confirm
-   ```
-
-## Support
-
-For issues related to lock debugging:
-- Check logs for 🔍 [LOCK-DEBUG] entries
-- Verify PostgreSQL version supports ALTER SYSTEM (9.4+)
-- Ensure user has SUPERUSER role for ALTER SYSTEM
-- Check systemd/init scripts can restart PostgreSQL
-
-Related documentation:
-- verify_postgres_locks.sh - Script to check lock configuration
-- v3.42.82 release notes - Lock exhaustion bug fixes

docs/METRICS.md

@@ -1,314 +0,0 @@
-# DBBackup Prometheus Metrics
-
-This document describes all Prometheus metrics exposed by DBBackup for monitoring and alerting.
-
-## Backup Status Metrics
-
-### `dbbackup_rpo_seconds`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `backup_type`  
-**Description:** Time in seconds since the last successful backup (Recovery Point Objective).
-
-**Recommended Thresholds:**
-- Green: < 43200 (12 hours)
-- Yellow: 43200-86400 (12-24 hours)  
-- Red: > 86400 (24+ hours)
-
-**Example Query:**
-```promql
-dbbackup_rpo_seconds{server="prod-db-01"} > 86400
-
-# RPO by backup type
-dbbackup_rpo_seconds{backup_type="full"}
-dbbackup_rpo_seconds{backup_type="incremental"}
-```
-
----
-
-### `dbbackup_backup_total`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `status`  
-**Description:** Total count of backup attempts, labeled by status (`success` or `failure`).
-
-**Example Query:**
-```promql
-# Total successful backups
-dbbackup_backup_total{status="success"}
-```
-
----
-
-### `dbbackup_backup_by_type`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `backup_type`  
-**Description:** Total count of backups by backup type (`full`, `incremental`, `pitr_base`).
-
-> **Note:** The `backup_type` label values are:
-> - `full` - Created with `--backup-type full` (default)
-> - `incremental` - Created with `--backup-type incremental`
-> - `pitr_base` - Auto-assigned when using `dbbackup pitr base` command
->
-> The CLI `--backup-type` flag only accepts `full` or `incremental`.
-
-**Example Query:**
-```promql
-# Count of each backup type
-dbbackup_backup_by_type{backup_type="full"}
-dbbackup_backup_by_type{backup_type="incremental"}
-dbbackup_backup_by_type{backup_type="pitr_base"}
-```
-
----
-
-### `dbbackup_backup_verified`
-**Type:** Gauge  
-**Labels:** `server`, `database`  
-**Description:** Whether the most recent backup was verified successfully (1 = verified, 0 = not verified).
-
----
-
-### `dbbackup_last_backup_size_bytes`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`, `backup_type`  
-**Description:** Size of the last successful backup in bytes.
-
-**Example Query:**
-```promql
-# Total backup storage across all databases
-sum(dbbackup_last_backup_size_bytes)
-
-# Size by backup type
-dbbackup_last_backup_size_bytes{backup_type="full"}
-```
-
----
-
-### `dbbackup_last_backup_duration_seconds`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`, `backup_type`  
-**Description:** Duration of the last backup operation in seconds.
-
----
-
-### `dbbackup_last_success_timestamp`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`, `backup_type`  
-**Description:** Unix timestamp of the last successful backup.
-
----
-
-## PITR (Point-in-Time Recovery) Metrics
-
-### `dbbackup_pitr_enabled`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`  
-**Description:** Whether PITR is enabled for the database (1 = enabled, 0 = disabled).
-
-**Example Query:**
-```promql
-# Check if PITR is enabled
-dbbackup_pitr_enabled{database="production"} == 1
-```
-
----
-
-### `dbbackup_pitr_last_archived_timestamp`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`  
-**Description:** Unix timestamp of the last archived WAL segment (PostgreSQL) or binlog file (MySQL).
-
----
-
-### `dbbackup_pitr_archive_lag_seconds`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`  
-**Description:** Seconds since the last WAL/binlog was archived. High values indicate archiving issues.
-
-**Recommended Thresholds:**
-- Green: < 300 (5 minutes)
-- Yellow: 300-600 (5-10 minutes)
-- Red: > 600 (10+ minutes)
-
-**Example Query:**
-```promql
-# Alert on high archive lag
-dbbackup_pitr_archive_lag_seconds > 600
-```
-
----
-
-### `dbbackup_pitr_archive_count`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`  
-**Description:** Total number of archived WAL segments or binlog files.
-
----
-
-### `dbbackup_pitr_archive_size_bytes`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`  
-**Description:** Total size of archived logs in bytes.
-
----
-
-### `dbbackup_pitr_chain_valid`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`  
-**Description:** Whether the WAL/binlog chain is valid (1 = valid, 0 = gaps detected).
-
-**Example Query:**
-```promql
-# Alert on broken chain
-dbbackup_pitr_chain_valid == 0
-```
-
----
-
-### `dbbackup_pitr_gap_count`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`  
-**Description:** Number of gaps detected in the WAL/binlog chain. Any value > 0 requires investigation.
-
----
-
-### `dbbackup_pitr_recovery_window_minutes`
-**Type:** Gauge  
-**Labels:** `server`, `database`, `engine`  
-**Description:** Estimated recovery window in minutes - the time span covered by archived logs.
-
----
-
-## Deduplication Metrics
-
-### `dbbackup_dedup_ratio`
-**Type:** Gauge  
-**Labels:** `server`  
-**Description:** Overall deduplication efficiency (0-1). A ratio of 0.5 means 50% space savings.
-
----
-
-### `dbbackup_dedup_database_ratio`
-**Type:** Gauge  
-**Labels:** `server`, `database`  
-**Description:** Per-database deduplication ratio.
-
----
-
-### `dbbackup_dedup_space_saved_bytes`
-**Type:** Gauge  
-**Labels:** `server`  
-**Description:** Total bytes saved by deduplication across all backups.
-
----
-
-### `dbbackup_dedup_disk_usage_bytes`
-**Type:** Gauge  
-**Labels:** `server`  
-**Description:** Actual disk usage of the chunk store after deduplication.
-
----
-
-### `dbbackup_dedup_chunks_total`
-**Type:** Gauge  
-**Labels:** `server`  
-**Description:** Total number of unique content-addressed chunks in the dedup store.
-
----
-
-### `dbbackup_dedup_compression_ratio`
-**Type:** Gauge  
-**Labels:** `server`  
-**Description:** Compression ratio achieved on chunk data (0-1). Higher = better compression.
-
----
-
-### `dbbackup_dedup_oldest_chunk_timestamp`
-**Type:** Gauge  
-**Labels:** `server`  
-**Description:** Unix timestamp of the oldest chunk. Useful for monitoring retention policy.
-
----
-
-### `dbbackup_dedup_newest_chunk_timestamp`
-**Type:** Gauge  
-**Labels:** `server`  
-**Description:** Unix timestamp of the newest chunk. Confirms dedup is working on recent backups.
-
----
-
-## Build Information Metrics
-
-### `dbbackup_build_info`
-**Type:** Gauge  
-**Labels:** `server`, `version`, `commit`, `build_time`  
-**Description:** Build information for the dbbackup exporter. Value is always 1.
-
-This metric is useful for:
-- Tracking which version is deployed across your fleet
-- Alerting when versions drift between servers
-- Correlating behavior changes with deployments
-
-**Example Queries:**
-```promql
-# Show all deployed versions
-group by (version) (dbbackup_build_info)
-
-# Find servers not on latest version
-dbbackup_build_info{version!="4.1.4"}
-
-# Alert on version drift
-count(count by (version) (dbbackup_build_info)) > 1
-
-# PITR archive lag
-dbbackup_pitr_archive_lag_seconds > 600
-
-# Check PITR chain integrity
-dbbackup_pitr_chain_valid == 1
-
-# Estimate available PITR window (in minutes)
-dbbackup_pitr_recovery_window_minutes
-
-# PITR gaps detected
-dbbackup_pitr_gap_count > 0
-```
-
----
-
-## Alerting Rules
-
-See [alerting-rules.yaml](../grafana/alerting-rules.yaml) for pre-configured Prometheus alerting rules.
-
-### Recommended Alerts
-
-| Alert Name | Condition | Severity |
-|------------|-----------|----------|
-| BackupStale | `dbbackup_rpo_seconds > 86400` | Critical |
-| BackupFailed | `increase(dbbackup_backup_total{status="failure"}[1h]) > 0` | Warning |
-| BackupNotVerified | `dbbackup_backup_verified == 0` | Warning |
-| DedupDegraded | `dbbackup_dedup_ratio < 0.1` | Info |
-| PITRArchiveLag | `dbbackup_pitr_archive_lag_seconds > 600` | Warning |
-| PITRChainBroken | `dbbackup_pitr_chain_valid == 0` | Critical |
-| PITRDisabled | `dbbackup_pitr_enabled == 0` (unexpected) | Critical |
-| NoIncrementalBackups | `dbbackup_backup_by_type{backup_type="incremental"} == 0` for 7d | Info |
-
----
-
-## Dashboard
-
-Import the [Grafana dashboard](../grafana/dbbackup-dashboard.json) for visualization of all metrics.
-
-## Exporting Metrics
-
-Metrics are exposed at `/metrics` when running with `--metrics` flag:
-
-```bash
-dbbackup backup cluster --metrics --metrics-port 9090
-```
-
-Or configure in `.dbbackup.conf`:
-```ini
-[metrics]
-enabled = true
-port = 9090
-path = /metrics
-```

docs/RESTORE_PROFILES.md

@@ -1,223 +0,0 @@
-# Restore Profiles
-
-## Overview
-
-The `--profile` flag allows you to optimize restore operations based on your server's resources and current workload. This is particularly useful when dealing with "out of shared memory" errors or resource-constrained environments.
-
-## Available Profiles
-
-### Conservative Profile (`--profile=conservative`)
-**Best for:** Resource-constrained servers, production systems with other running services, or when dealing with "out of shared memory" errors.
-
-**Settings:**
-- Single-threaded restore (`--parallel=1`)
-- Single-threaded decompression (`--jobs=1`)
-- Memory-conservative mode enabled
-- Minimal memory footprint
-
-**When to use:**
-- Server RAM usage > 70%
-- Other critical services running (web servers, monitoring agents)
-- "out of shared memory" errors during restore
-- Small VMs or shared hosting environments
-- Disk I/O is the bottleneck
-
-**Example:**
-```bash
-dbbackup restore cluster backup.tar.gz --profile=conservative --confirm
-```
-
-### Balanced Profile (`--profile=balanced`) - DEFAULT
-**Best for:** Most scenarios, general-purpose servers with adequate resources.
-
-**Settings:**
-- Auto-detect parallelism based on CPU/RAM
-- Moderate resource usage
-- Good balance between speed and stability
-
-**When to use:**
-- Default choice for most restores
-- Dedicated database server with moderate load
-- Unknown or variable server conditions
-
-**Example:**
-```bash
-dbbackup restore cluster backup.tar.gz --confirm
-# or explicitly:
-dbbackup restore cluster backup.tar.gz --profile=balanced --confirm
-```
-
-### Aggressive Profile (`--profile=aggressive`)
-**Best for:** Dedicated database servers with ample resources, maintenance windows, performance-critical restores.
-
-**Settings:**
-- Maximum parallelism (auto-detect based on CPU cores)
-- Maximum resource utilization
-- Fastest restore speed
-
-**When to use:**
-- Dedicated database server (no other services)
-- Server RAM usage < 50%
-- Time-critical restores (RTO minimization)
-- Maintenance windows with service downtime
-- Testing/development environments
-
-**Example:**
-```bash
-dbbackup restore cluster backup.tar.gz --profile=aggressive --confirm
-```
-
-### Potato Profile (`--profile=potato`)
-**Easter egg:** Same as conservative, for servers running on a potato.
-
-### Turbo Profile (`--profile=turbo`)
-**NEW! Best for:** Maximum restore speed - matches native pg_restore -j8 performance.
-
-**Settings:**
-- Parallel databases: 2 (balanced I/O)
-- pg_restore jobs: 8 (like `pg_restore -j8`)
-- Buffered I/O: 32KB write buffers for faster extraction
-- Optimized for large databases
-
-**When to use:**
-- Dedicated database server
-- Need fastest possible restore (DR scenarios)
-- Server has 16GB+ RAM, 4+ cores
-- Large databases (100GB+)
-- You want dbbackup to match pg_restore speed
-
-**Example:**
-```bash
-dbbackup restore cluster backup.tar.gz --profile=turbo --confirm
-```
-
-**TUI Usage:**
-1. Go to Settings → Resource Profile
-2. Press Enter to cycle until you see "turbo"
-3. Save settings and run restore
-
-## Profile Comparison
-
-| Setting | Conservative | Balanced | Performance | Turbo |
-|---------|-------------|----------|-------------|----------|
-| Parallel DBs | 1 | 2 | 4 | 2 |
-| pg_restore Jobs | 1 | 2 | 4 | 8 |
-| Buffered I/O | No | No | No | Yes (32KB) |
-| Memory Usage | Minimal | Moderate | High | Moderate |
-| Speed | Slowest | Medium | Fast | **Fastest** |
-| Stability | Most stable | Stable | Good | Good |
-| Best For | Small VMs | General use | Powerful servers | DR/Large DBs |
-
-## Overriding Profile Settings
-
-You can override specific profile settings:
-
-```bash
-# Use conservative profile but allow 2 parallel jobs for decompression
-dbbackup restore cluster backup.tar.gz \\
-  --profile=conservative \\
-  --jobs=2 \\
-  --confirm
-
-# Use aggressive profile but limit to 2 parallel databases
-dbbackup restore cluster backup.tar.gz \\
-  --profile=aggressive \\
-  --parallel-dbs=2 \\
-  --confirm
-```
-
-## Real-World Scenarios
-
-### Scenario 1: "Out of Shared Memory" Error
-**Problem:** PostgreSQL restore fails with `ERROR: out of shared memory`
-
-**Solution:**
-```bash
-# Step 1: Use conservative profile
-dbbackup restore cluster backup.tar.gz --profile=conservative --confirm
-
-# Step 2: If still failing, temporarily stop monitoring agents
-sudo systemctl stop nessus-agent elastic-agent
-dbbackup restore cluster backup.tar.gz --profile=conservative --confirm
-sudo systemctl start nessus-agent elastic-agent
-
-# Step 3: Ask infrastructure team to increase work_mem (see email_infra_team.txt)
-```
-
-### Scenario 2: Fast Disaster Recovery
-**Goal:** Restore as quickly as possible during maintenance window
-
-**Solution:**
-```bash
-# Stop all non-essential services first
-sudo systemctl stop nginx php-fpm
-dbbackup restore cluster backup.tar.gz --profile=aggressive --confirm
-sudo systemctl start nginx php-fpm
-```
-
-### Scenario 3: Shared Server with Multiple Services
-**Environment:** Web server + database + monitoring all on same VM
-
-**Solution:**
-```bash
-# Always use conservative to avoid impacting other services
-dbbackup restore cluster backup.tar.gz --profile=conservative --confirm
-```
-
-### Scenario 4: Unknown Server Conditions
-**Situation:** Restoring to a new server, unsure of resources
-
-**Solution:**
-```bash
-# Step 1: Run diagnostics first
-./diagnose_postgres_memory.sh > diagnosis.log
-
-# Step 2: Choose profile based on memory usage:
-# - If memory > 80%: use conservative
-# - If memory 50-80%: use balanced (default)
-# - If memory < 50%: use aggressive
-
-# Step 3: Start with balanced and adjust if needed
-dbbackup restore cluster backup.tar.gz --confirm
-```
-
-## Troubleshooting
-
-### Profile Selection Guide
-
-**Use Conservative when:**
-- ✅ Memory usage > 70%
-- ✅ Other services running
-- ✅ Getting "out of shared memory" errors
-- ✅ Restore keeps failing
-- ✅ Small VM (< 4 GB RAM)
-- ✅ High swap usage
-
-**Use Balanced when:**
-- ✅ Normal operation
-- ✅ Moderate server load
-- ✅ Unsure what to use
-- ✅ Medium VM (4-16 GB RAM)
-
-**Use Aggressive when:**
-- ✅ Dedicated database server
-- ✅ Memory usage < 50%
-- ✅ No other critical services
-- ✅ Need fastest possible restore
-- ✅ Large VM (> 16 GB RAM)
-- ✅ Maintenance window
-
-## Environment Variables
-
-You can set a default profile:
-
-```bash
-export RESOURCE_PROFILE=conservative
-dbbackup restore cluster backup.tar.gz --confirm
-```
-
-## See Also
-
-- [diagnose_postgres_memory.sh](diagnose_postgres_memory.sh) - Analyze system resources before restore
-- [fix_postgres_locks.sh](fix_postgres_locks.sh) - Fix PostgreSQL lock exhaustion
-- [email_infra_team.txt](email_infra_team.txt) - Template email for infrastructure team

docs/RTO.md

@@ -1,364 +0,0 @@
-# RTO/RPO Analysis
-
-Complete reference for Recovery Time Objective (RTO) and Recovery Point Objective (RPO) analysis and calculation.
-
-## Overview
-
-RTO and RPO are critical metrics for disaster recovery planning:
-
-- **RTO (Recovery Time Objective)** - Maximum acceptable time to restore systems
-- **RPO (Recovery Point Objective)** - Maximum acceptable data loss (time)
-
-dbbackup calculates these based on:
-- Backup size and compression
-- Database size and transaction rate
-- Network bandwidth
-- Hardware resources
-- Retention policy
-
-## Quick Start
-
-```bash
-# Show RTO/RPO analysis
-dbbackup rto show
-
-# Show recommendations
-dbbackup rto recommendations
-
-# Export for disaster recovery plan
-dbbackup rto export --format pdf --output drp.pdf
-```
-
-## RTO Calculation
-
-RTO depends on restore operations:
-
-```
-RTO = Time to: Extract + Restore + Validation
-
-Extract Time = Backup Size / Extraction Speed (~500 MB/s typical)
-Restore Time = Total Operations / Database Write Speed (~10-100K rows/sec)
-Validation = Backup Verify (~10% of restore time)
-```
-
-### Example
-
-```
-Backup: myapp_production
-- Size on disk: 2.5 GB
-- Compressed: 850 MB
-
-Extract Time = 850 MB / 500 MB/s = 1.7 minutes
-Restore Time = 1.5M rows / 50K rows/sec = 30 minutes
-Validation = 3 minutes
-
-Total RTO = 34.7 minutes
-```
-
-## RPO Calculation
-
-RPO depends on backup frequency and transaction rate:
-
-```
-RPO = Backup Interval + WAL Replay Time
-
-Example with daily backups:
-- Backup interval: 24 hours
-- WAL available for PITR: +6 hours
-
-RPO = 24-30 hours (worst case)
-```
-
-### Optimizing RPO
-
-Reduce RPO by:
-
-```bash
-# More frequent backups (hourly vs daily)
-dbbackup backup single myapp --schedule "0 * * * *"  # Every hour
-
-# Enable PITR (Point-in-Time Recovery)
-dbbackup pitr enable myapp /mnt/wal
-dbbackup pitr base myapp /mnt/wal
-
-# Continuous WAL archiving
-dbbackup pitr status myapp /mnt/wal
-```
-
-With PITR enabled:
-```
-RPO = Time since last transaction (typically < 5 minutes)
-```
-
-## Analysis Command
-
-### Show Current Metrics
-
-```bash
-dbbackup rto show
-```
-
-Output:
-```
-Database: production
-Engine: PostgreSQL 15
-
-Current Status:
-  Last Backup:           2026-01-23 02:00:00 (22 hours ago)
-  Backup Size:           2.5 GB (compressed: 850 MB)
-  RTO Estimate:          35 minutes
-  RPO Current:           22 hours
-  PITR Enabled:          yes
-  PITR Window:           6 hours
-  
-Recommendations:
-  - RTO is acceptable (< 1 hour)
-  - RPO could be improved with hourly backups (currently 22h)
-  - PITR reduces RPO to 6 hours in case of full backup loss
-  
-Recovery Plans:
-  Scenario 1: Full database loss
-    RTO: 35 minutes (restore from latest backup)
-    RPO: 22 hours (data since last backup lost)
-    
-  Scenario 2: Point-in-time recovery
-    RTO: 45 minutes (restore backup + replay WAL)
-    RPO: 5 minutes (last transaction available)
-    
-  Scenario 3: Table-level recovery (single table drop)
-    RTO: 30 minutes (restore to temp DB, extract table)
-    RPO: 22 hours
-```
-
-### Get Recommendations
-
-```bash
-dbbackup rto recommendations
-
-# Output includes:
-# - Suggested backup frequency
-# - PITR recommendations
-# - Parallelism recommendations
-# - Resource utilization tips
-# - Cost-benefit analysis
-```
-
-## Scenarios
-
-### Scenario Analysis
-
-Calculate RTO/RPO for different failure modes.
-
-```bash
-# Full database loss (use latest backup)
-dbbackup rto scenario --type full-loss
-
-# Point-in-time recovery (specific time before incident)
-dbbackup rto scenario --type point-in-time --time "2026-01-23 14:30:00"
-
-# Table-level recovery
-dbbackup rto scenario --type table-level --table users
-
-# Multiple databases
-dbbackup rto scenario --type multi-db --databases myapp,mydb
-```
-
-### Custom Scenario
-
-```bash
-# Network bandwidth constraint
-dbbackup rto scenario \
-  --type full-loss \
-  --bandwidth 10MB/s \
-  --storage-type s3
-
-# Limited resources (small restore server)
-dbbackup rto scenario \
-  --type full-loss \
-  --cpu-cores 4 \
-  --memory-gb 8
-
-# High transaction rate database
-dbbackup rto scenario \
-  --type point-in-time \
-  --tps 100000
-```
-
-## Monitoring
-
-### Track RTO/RPO Trends
-
-```bash
-# Show trend over time
-dbbackup rto history
-
-# Export metrics for trending
-dbbackup rto export --format csv
-
-# Output:
-# Date,Database,RTO_Minutes,RPO_Hours,Backup_Size_GB,Status
-# 2026-01-15,production,35,22,2.5,ok
-# 2026-01-16,production,35,22,2.5,ok
-# 2026-01-17,production,38,24,2.6,warning
-```
-
-### Alert on RTO/RPO Violations
-
-```bash
-# Alert if RTO > 1 hour
-dbbackup rto alert --type rto-violation --threshold 60
-
-# Alert if RPO > 24 hours
-dbbackup rto alert --type rpo-violation --threshold 24
-
-# Email on violations
-dbbackup rto alert \
-  --type rpo-violation \
-  --threshold 24 \
-  --notify-email admin@example.com
-```
-
-## Detailed Calculations
-
-### Backup Time Components
-
-```bash
-# Analyze last backup performance
-dbbackup rto backup-analysis
-
-# Output:
-#   Database: production
-#   Backup Date: 2026-01-23 02:00:00
-#   Total Duration: 45 minutes
-#   
-#   Components:
-#   - Data extraction:  25m 30s (56%)
-#   - Compression:      12m 15s (27%)
-#   - Encryption:       5m 45s  (13%)
-#   - Upload to cloud:  1m 30s  (3%)
-#   
-#   Throughput: 95 MB/s
-#   Compression Ratio: 65%
-```
-
-### Restore Time Components
-
-```bash
-# Analyze restore performance from a test drill
-dbbackup rto restore-analysis myapp_2026-01-23.dump.gz
-
-# Output:
-#   Extract Time:       1m 45s
-#   Restore Time:       28m 30s
-#   Validation:         3m 15s
-#   Total RTO:          33m 30s
-#   
-#   Restore Speed:      2.8M rows/minute
-#   Objects Created:    4200
-#   Indexes Built:      145
-```
-
-## Configuration
-
-Configure RTO/RPO targets in `.dbbackup.conf`:
-
-```ini
-[rto_rpo]
-# Target RTO (minutes)
-target_rto_minutes = 60
-
-# Target RPO (hours)
-target_rpo_hours = 4
-
-# Alert on threshold violation
-alert_on_violation = true
-
-# Minimum backups to maintain RTO
-min_backups_for_rto = 5
-
-# PITR window target (hours)
-pitr_window_hours = 6
-```
-
-## SLAs and Compliance
-
-### Define SLA
-
-```bash
-# Create SLA requirement
-dbbackup rto sla \
-  --name production \
-  --target-rto-minutes 30 \
-  --target-rpo-hours 4 \
-  --databases myapp,payments
-
-# Verify compliance
-dbbackup rto sla --verify production
-
-# Generate compliance report
-dbbackup rto sla --report production
-```
-
-### Audit Trail
-
-```bash
-# Show RTO/RPO audit history
-dbbackup rto audit
-
-# Output shows:
-# Date                  Metric  Value     Target    Status
-# 2026-01-25 03:15:00  RTO     35m       60m       PASS
-# 2026-01-25 03:15:00  RPO     22h       4h        FAIL
-# 2026-01-24 03:00:00  RTO     35m       60m       PASS
-# 2026-01-24 03:00:00  RPO     22h       4h        FAIL
-```
-
-## Reporting
-
-### Generate Report
-
-```bash
-# Markdown report
-dbbackup rto report --format markdown --output rto-report.md
-
-# PDF for disaster recovery plan
-dbbackup rto report --format pdf --output drp.pdf
-
-# HTML for dashboard
-dbbackup rto report --format html --output rto-metrics.html
-```
-
-## Best Practices
-
-1. **Define SLA targets** - Start with business requirements
-   - Critical systems: RTO < 1 hour
-   - Important systems: RTO < 4 hours
-   - Standard systems: RTO < 24 hours
-
-2. **Test RTO regularly** - DR drills validate estimates
-   ```bash
-   dbbackup drill /mnt/backups --full-validation
-   ```
-
-3. **Monitor trends** - Increasing RTO may indicate issues
-
-4. **Optimize backups** - Faster backups = smaller RTO
-   - Increase parallelism
-   - Use faster storage
-   - Optimize compression level
-
-5. **Plan for PITR** - Critical systems should have PITR enabled
-   ```bash
-   dbbackup pitr enable myapp /mnt/wal
-   ```
-
-6. **Document assumptions** - RTO/RPO calculations depend on:
-   - Available bandwidth
-   - Target hardware
-   - Parallelism settings
-   - Database size changes
-
-7. **Regular audit** - Monthly SLA compliance review
-   ```bash
-   dbbackup rto sla --verify production
-   ```

go.mod

@@ -5,33 +5,15 @@ go 1.24.0
 toolchain go1.24.9
 
 require (
-	cloud.google.com/go/storage v1.57.2
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.3
-	github.com/aws/aws-sdk-go-v2 v1.40.0
-	github.com/aws/aws-sdk-go-v2/config v1.32.2
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.2
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.12
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.92.1
-	github.com/cenkalti/backoff/v4 v4.3.0
+	github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2
 	github.com/charmbracelet/bubbles v0.21.0
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
-	github.com/dustin/go-humanize v1.0.1
-	github.com/fatih/color v1.18.0
 	github.com/go-sql-driver/mysql v1.9.3
-	github.com/hashicorp/go-multierror v1.1.1
 	github.com/jackc/pgx/v5 v5.7.6
-	github.com/klauspost/pgzip v1.2.6
-	github.com/schollz/progressbar/v3 v3.19.0
-	github.com/shirou/gopsutil/v3 v3.24.5
 	github.com/sirupsen/logrus v1.9.3
-	github.com/spf13/afero v1.15.0
 	github.com/spf13/cobra v1.10.1
 	github.com/spf13/pflag v1.0.9
-	golang.org/x/crypto v0.43.0
-	google.golang.org/api v0.256.0
-	modernc.org/sqlite v1.44.3
 )
 
 require (
@@ -42,13 +24,20 @@ require (
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	cloud.google.com/go/iam v1.5.2 // indirect
 	cloud.google.com/go/monitoring v1.24.2 // indirect
+	cloud.google.com/go/storage v1.57.2 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.3 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.40.0 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.32.2 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.2 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.14 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.12 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.14 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.14 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
@@ -57,6 +46,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.14 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.14 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.92.1 // indirect
 	github.com/aws/aws-sdk-go-v2/service/signin v1.0.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.30.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.10 // indirect
@@ -69,6 +59,7 @@ require (
 	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
 	github.com/charmbracelet/x/term v0.2.1 // indirect
 	github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect
+	github.com/creack/pty v1.1.17 // indirect
 	github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
@@ -76,37 +67,26 @@ require (
 	github.com/go-jose/go-jose/v4 v4.1.2 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect
 	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
-	github.com/klauspost/compress v1.18.3 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
-	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
-	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
+	github.com/mattn/go-sqlite3 v1.14.32 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
-	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
-	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
-	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
-	github.com/tklauser/go-sysconf v0.3.12 // indirect
-	github.com/tklauser/numcpus v0.6.1 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	github.com/zeebo/errs v1.4.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect
@@ -117,20 +97,17 @@ require (
 	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
 	go.opentelemetry.io/otel/sdk/metric v1.37.0 // indirect
 	go.opentelemetry.io/otel/trace v1.37.0 // indirect
-	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
+	golang.org/x/crypto v0.43.0 // indirect
 	golang.org/x/net v0.46.0 // indirect
 	golang.org/x/oauth2 v0.33.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/sync v0.18.0 // indirect
 	golang.org/x/sys v0.38.0 // indirect
-	golang.org/x/term v0.36.0 // indirect
 	golang.org/x/text v0.30.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
+	google.golang.org/api v0.256.0 // indirect
 	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101 // indirect
 	google.golang.org/grpc v1.76.0 // indirect
 	google.golang.org/protobuf v1.36.10 // indirect
-	modernc.org/libc v1.67.6 // indirect
-	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.11.0 // indirect
 )

go.sum

@@ -10,44 +10,36 @@ cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdB
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
 cloud.google.com/go/iam v1.5.2 h1:qgFRAGEmd8z6dJ/qyEchAuL9jpswyODjA2lS+w234g8=
 cloud.google.com/go/iam v1.5.2/go.mod h1:SE1vg0N81zQqLzQEwxL2WI6yhetBdbNQuTvIKCSkUHE=
-cloud.google.com/go/logging v1.13.0 h1:7j0HgAp0B94o1YRDqiqm26w4q1rDMH7XNRU34lJXHYc=
-cloud.google.com/go/logging v1.13.0/go.mod h1:36CoKh6KA/M0PbhPKMq6/qety2DCAErbhXT62TuXALA=
-cloud.google.com/go/longrunning v0.7.0 h1:FV0+SYF1RIj59gyoWDRi45GiYUMM3K1qO51qoboQT1E=
-cloud.google.com/go/longrunning v0.7.0/go.mod h1:ySn2yXmjbK9Ba0zsQqunhDkYi0+9rlXIwnoAf+h+TPY=
 cloud.google.com/go/monitoring v1.24.2 h1:5OTsoJ1dXYIiMiuL+sYscLc9BumrL3CarVLL7dd7lHM=
 cloud.google.com/go/monitoring v1.24.2/go.mod h1:x7yzPWcgDRnPEv3sI+jJGBkwl5qINf+6qY4eq0I9B4U=
 cloud.google.com/go/storage v1.57.2 h1:sVlym3cHGYhrp6XZKkKb+92I1V42ks2qKKpB0CF5Mb4=
 cloud.google.com/go/storage v1.57.2/go.mod h1:n5ijg4yiRXXpCu0sJTD6k+eMf7GRrJmPyr9YxLXGHOk=
-cloud.google.com/go/trace v1.11.6 h1:2O2zjPzqPYAHrn3OKl029qlqG6W8ZdYaOWRyr8NgMT4=
-cloud.google.com/go/trace v1.11.6/go.mod h1:GA855OeDEBiBMzcckLPE2kDunIpC72N+Pq8WFieFjnI=
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.0 h1:KpMC6LFL7mqpExyMC9jVOYRiVhLmamjeZfRsUpB7l4s=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.0/go.mod h1:J7MUC/wtRpfGVbQ5sIItY5/FuVWmvzlY21WAOfQnq/I=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1 h1:/Zt+cDPnpC3OVDm/JKLOs7M2DKmLRIIp3XIx9pHHiig=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1/go.mod h1:Ng3urmn6dYe8gnbCMoHHVl5APYz2txho3koEkV2o2HA=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.3 h1:ZJJNFaQ86GVKQ9ehwqyAFE6pIfyicpuJ8IkVaPBc6/4=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.3/go.mod h1:URuDvhmATVKqHBH9/0nOiNKk0+YcwfQ3WkK5PqHKxc8=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 h1:XkkQbfMyuH2jTSjQjSoihryI8GINRcs4xp8lNawg0FI=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 h1:UQUsRi8WTzhZntp5313l+CHIAT95ojUI2lpP/ExlZa4=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0/go.mod h1:Cz6ft6Dkn3Et6l2v2a9/RpN7epQ1GtDlO6lj8bEcOvw=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 h1:owcC2UnmsZycprQ5RfRgjydWhuoxg71LUfyiQdijZuM=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0/go.mod h1:ZPpqegjbE99EPKsu3iUWV22A04wzGPcAY/ziSIQEEgs=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.53.0 h1:4LP6hvB4I5ouTbGgWtixJhgED6xdf67twf9PoY96Tbg=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.53.0/go.mod h1:jUZ5LYlw40WMd07qxcQJD5M40aUxrfwqQX1g7zxYnrQ=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 h1:Ron4zCA/yk6U7WOBXhTJcDpsUBG9npumK6xw2auFltQ=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0/go.mod h1:cSgYe11MCNYunTnRXrKiR/tHc0eoKjICUuWpNZoVCOo=
+github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
+github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
 github.com/aws/aws-sdk-go-v2 v1.40.0 h1:/WMUA0kjhZExjOQN2z3oLALDREea1A7TobfuiBrKlwc=
 github.com/aws/aws-sdk-go-v2 v1.40.0/go.mod h1:c9pm7VwuW0UPxAEYGyTmyurVcNrbF6Rt/wixFqDhcjE=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3 h1:DHctwEM8P8iTXFxC/QK0MRjwEpWQeM9yzidCRjldUz0=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3/go.mod h1:xdCzcZEtnSTKVDOmUZs4l/j3pSV6rpo1WXl5ugNsL8Y=
+github.com/aws/aws-sdk-go-v2/config v1.32.1 h1:iODUDLgk3q8/flEC7ymhmxjfoAnBDwEEYEVyKZ9mzjU=
+github.com/aws/aws-sdk-go-v2/config v1.32.1/go.mod h1:xoAgo17AGrPpJBSLg81W+ikM0cpOZG8ad04T2r+d5P0=
 github.com/aws/aws-sdk-go-v2/config v1.32.2 h1:4liUsdEpUUPZs5WVapsJLx5NPmQhQdez7nYFcovrytk=
 github.com/aws/aws-sdk-go-v2/config v1.32.2/go.mod h1:l0hs06IFz1eCT+jTacU/qZtC33nvcnLADAPL/XyrkZI=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.1 h1:JeW+EwmtTE0yXFK8SmklrFh/cGTTXsQJumgMZNlbxfM=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.1/go.mod h1:BOoXiStwTF+fT2XufhO0Efssbi1CNIO/ZXpZu87N0pw=
 github.com/aws/aws-sdk-go-v2/credentials v1.19.2 h1:qZry8VUyTK4VIo5aEdUcBjPZHL2v4FyQ3QEOaWcFLu4=
 github.com/aws/aws-sdk-go-v2/credentials v1.19.2/go.mod h1:YUqm5a1/kBnoK+/NY5WEiMocZihKSo15/tJdmdXnM5g=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.14 h1:WZVR5DbDgxzA0BJeudId89Kmgy6DIU4ORpxwsVHz0qA=
@@ -70,22 +62,30 @@ github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.14 h1:FIouAnCE
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.14/go.mod h1:UTwDc5COa5+guonQU8qBikJo1ZJ4ln2r1MkF7Dqag1E=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.14 h1:FzQE21lNtUor0Fb7QNgnEyiRCBlolLTX/Z1j65S7teM=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.14/go.mod h1:s1ydyWG9pm3ZwmmYN21HKyG9WzAZhYVW85wMHs5FV6w=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.92.0 h1:8FshVvnV2sr9kOSAbOnc/vwVmmAwMjOedKH6JW2ddPM=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.92.0/go.mod h1:wYNqY3L02Z3IgRYxOBPH9I1zD9Cjh9hI5QOy/eOjQvw=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.92.1 h1:OgQy/+0+Kc3khtqiEOk23xQAglXi3Tj0y5doOxbi5tg=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.92.1/go.mod h1:wYNqY3L02Z3IgRYxOBPH9I1zD9Cjh9hI5QOy/eOjQvw=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.1 h1:BDgIUYGEo5TkayOWv/oBLPphWwNm/A91AebUjAu5L5g=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.1/go.mod h1:iS6EPmNeqCsGo+xQmXv0jIMjyYtQfnwg36zl2FwEouk=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.2 h1:MxMBdKTYBjPQChlJhi4qlEueqB1p1KcbTEa7tD5aqPs=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.2/go.mod h1:iS6EPmNeqCsGo+xQmXv0jIMjyYtQfnwg36zl2FwEouk=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.4 h1:U//SlnkE1wOQiIImxzdY5PXat4Wq+8rlfVEw4Y7J8as=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.4/go.mod h1:av+ArJpoYf3pgyrj6tcehSFW+y9/QvAY8kMooR9bZCw=
 github.com/aws/aws-sdk-go-v2/service/sso v1.30.5 h1:ksUT5KtgpZd3SAiFJNJ0AFEJVva3gjBmN7eXUZjzUwQ=
 github.com/aws/aws-sdk-go-v2/service/sso v1.30.5/go.mod h1:av+ArJpoYf3pgyrj6tcehSFW+y9/QvAY8kMooR9bZCw=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.9 h1:LU8S9W/mPDAU9q0FjCLi0TrCheLMGwzbRpvUMwYspcA=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.9/go.mod h1:/j67Z5XBVDx8nZVp9EuFM9/BS5dvBznbqILGuu73hug=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.10 h1:GtsxyiF3Nd3JahRBJbxLCCdYW9ltGQYrFWg8XdkGDd8=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.10/go.mod h1:/j67Z5XBVDx8nZVp9EuFM9/BS5dvBznbqILGuu73hug=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.1 h1:GdGmKtG+/Krag7VfyOXV17xjTCz0i9NT+JnqLTOI5nA=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.1/go.mod h1:6TxbXoDSgBQ225Qd8Q+MbxUxUh6TtNKwbRt/EPS9xso=
 github.com/aws/aws-sdk-go-v2/service/sts v1.41.2 h1:a5UTtD4mHBU3t0o6aHQZFJTNKVfxFWfPX7J0Lr7G+uY=
 github.com/aws/aws-sdk-go-v2/service/sts v1.41.2/go.mod h1:6TxbXoDSgBQ225Qd8Q+MbxUxUh6TtNKwbRt/EPS9xso=
 github.com/aws/smithy-go v1.23.2 h1:Crv0eatJUQhaManss33hS5r40CG3ZFH+21XSkqMrIUM=
 github.com/aws/smithy-go v1.23.2/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
-github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
-github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charmbracelet/bubbles v0.21.0 h1:9TdC97SdRVg/1aaXNVWfFH3nnLAwOXr8Fn6u6mfQdFs=
@@ -102,29 +102,20 @@ github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0G
 github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
 github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
 github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
-github.com/chengxilo/virtualterm v1.0.4 h1:Z6IpERbRVlfB8WkOmtbHiDbBANU7cimRIof7mk9/PwM=
-github.com/chengxilo/virtualterm v1.0.4/go.mod h1:DyxxBZz/x1iqJjFxTFcr6/x+jSpqN0iwWCOK1q10rlY=
 github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls=
 github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/creack/pty v1.1.17 h1:QeVUsEDNrLBW4tMgZHvxy18sKtr6VI492kBhUfhDJNI=
+github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
-github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/envoyproxy/go-control-plane v0.13.4 h1:zEqyPVyku6IvWCFwux4x9RxkLOMUL+1vC9xUFv5l2/M=
-github.com/envoyproxy/go-control-plane v0.13.4/go.mod h1:kDfuBlDVsSj2MjrLEtRWtHlsWIFcGyB2RMO44Dc5GZA=
 github.com/envoyproxy/go-control-plane/envoy v1.32.4 h1:jb83lalDRZSpPWW2Z7Mck/8kXZ5CQAFYVjQcdVIr83A=
 github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw=
-github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
-github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
 github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
 github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
-github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
-github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/go-jose/go-jose/v4 v4.1.2 h1:TK/7NqRQZfgAh+Td8AlsrvtPoUyiHh0LqVvokh+1vHI=
@@ -134,21 +125,8 @@ github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
-github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
 github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
-github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
-github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
-github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
-github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/martian/v3 v3.3.3 h1:DIhPTQrbPkgs2yJYdXU/eNACCG5DVQjySNRNlflZ9Fc=
-github.com/google/martian/v3 v3.3.3/go.mod h1:iEPrYcgCF7jA9OtScMFQyAlZZ4YXTKEtJ1E6RWzmBA0=
-github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
-github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -157,12 +135,6 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.7 h1:zrn2Ee/nWmHulBx5sAV
 github.com/googleapis/enterprise-certificate-proxy v0.3.7/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
 github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
 github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
-github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
-github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
-github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
@@ -173,58 +145,32 @@ github.com/jackc/pgx/v5 v5.7.6 h1:rWQc5FwZSPX58r1OQmkuaNicxdmExaEz5A2DO2hUuTk=
 github.com/jackc/pgx/v5 v5.7.6/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
-github.com/klauspost/compress v1.18.3 h1:9PJRvfbmTabkOX8moIpXPbMMbYN60bWImDDU7L+/6zw=
-github.com/klauspost/compress v1.18.3/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
-github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
-github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
-github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
-github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
 github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
-github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
-github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
 github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ=
-github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw=
+github.com/mattn/go-sqlite3 v1.14.32 h1:JD12Ag3oLy1zQA+BNn74xRgaBbdhbNIDYvQUEuuErjs=
+github.com/mattn/go-sqlite3 v1.14.32/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
 github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
 github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
-github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
-github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
-github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
-github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
-github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/schollz/progressbar/v3 v3.19.0 h1:Ea18xuIRQXLAUidVDox3AbwfUhD0/1IvohyTutOIFoc=
-github.com/schollz/progressbar/v3 v3.19.0/go.mod h1:IsO3lpbaGuzh8zIMzgY3+J8l4C8GjO0Y9S69eFvNsec=
-github.com/shirou/gopsutil/v3 v3.24.5 h1:i0t8kL+kQTvpAYToeuiVk3TgDeKOFioZO3Ztz/iZ9pI=
-github.com/shirou/gopsutil/v3 v3.24.5/go.mod h1:bsoOS1aStSs9ErQ1WWfxllSeS1K5D+U30r2NfcubMVk=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
-github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
 github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
 github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
@@ -233,17 +179,13 @@ github.com/spiffe/go-spiffe/v2 v2.5.0 h1:N2I01KCUkv1FAjZXJMwh95KK1ZIQLYbPfhaxw8W
 github.com/spiffe/go-spiffe/v2 v2.5.0/go.mod h1:P+NxobPc6wXhVtINNtFjNWGBTreew1GBUCwT2wPmb7g=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
-github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
-github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
-github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
-github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
-github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 github.com/zeebo/errs v1.4.0 h1:XNdoD/RRMKP7HD0UhJnIzUy74ISdGGxURlYG8HSWSfM=
 github.com/zeebo/errs v1.4.0/go.mod h1:sgbWHsvVuTPHcqJJGQ1WhI5KbWlHYz+2+2C/LSEtCw4=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
@@ -256,8 +198,6 @@ go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6h
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
 go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
 go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0 h1:rixTyDGXFxRy1xzhKrotaHy3/KXdPhlWARrCgK+eqUY=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0/go.mod h1:dowW6UsM9MKbJq5JTz2AMVp3/5iW5I/TStsk8S+CfHw=
 go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
 go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
 go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
@@ -266,39 +206,43 @@ go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFh
 go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
 go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
 go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
+golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
+golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
 golang.org/x/crypto v0.43.0 h1:dduJYIi3A3KOfdGOHX8AVZ/jGiyPa3IbBozJ5kNuE04=
 golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0=
-golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 h1:mgKeJMpvi0yx/sU5GsxQ7p6s2wtOnGAHZWCHUM4KGzY=
-golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:j/pmGrbnkbPtQfxEe5D0VQhZC6qKbfKifgD0oM7sR70=
-golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
-golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
+golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561 h1:MDc5xs78ZrZr3HMQugiXOAkSZtfTpbJLDr/lwfgO53E=
+golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
+golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/net v0.46.0 h1:giFlY12I07fugqwPuWJi68oOnpfqFnJIJzaIIm2JVV4=
 golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210=
 golang.org/x/oauth2 v0.33.0 h1:4Q+qn+E5z8gPRJfmRy7C2gGG3T4jIprK6aSYgTXGRpo=
 golang.org/x/oauth2 v0.33.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
-golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
+golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
 golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.36.0 h1:zMPR+aF8gfksFprF/Nc/rd1wRS1EI6nDBGyWAvDzx2Q=
-golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss=
+golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
+golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
 golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k=
 golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
-golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
-golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
 google.golang.org/api v0.256.0 h1:u6Khm8+F9sxbCTYNoBHg6/Hwv0N/i+V94MvkOSor6oI=
 google.golang.org/api v0.256.0/go.mod h1:KIgPhksXADEKJlnEoRa9qAII4rXcy40vfI8HRqcU964=
 google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
@@ -315,31 +259,3 @@ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-modernc.org/cc/v4 v4.27.1 h1:9W30zRlYrefrDV2JE2O8VDtJ1yPGownxciz5rrbQZis=
-modernc.org/cc/v4 v4.27.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
-modernc.org/ccgo/v4 v4.30.1 h1:4r4U1J6Fhj98NKfSjnPUN7Ze2c6MnAdL0hWw6+LrJpc=
-modernc.org/ccgo/v4 v4.30.1/go.mod h1:bIOeI1JL54Utlxn+LwrFyjCx2n2RDiYEaJVSrgdrRfM=
-modernc.org/fileutil v1.3.40 h1:ZGMswMNc9JOCrcrakF1HrvmergNLAmxOPjizirpfqBA=
-modernc.org/fileutil v1.3.40/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
-modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
-modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.1 h1:k8T3gkXWY9sEiytKhcgyiZ2L0DTyCQ/nvX+LoCljoRE=
-modernc.org/gc/v3 v3.1.1/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
-modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
-modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.67.6 h1:eVOQvpModVLKOdT+LvBPjdQqfrZq+pC39BygcT+E7OI=
-modernc.org/libc v1.67.6/go.mod h1:JAhxUVlolfYDErnwiqaLvUqc8nfb2r6S6slAgZOnaiE=
-modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
-modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
-modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
-modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
-modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
-modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
-modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.44.3 h1:+39JvV/HWMcYslAwRxHb8067w+2zowvFOUrOWIy9PjY=
-modernc.org/sqlite v1.44.3/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
-modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
-modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
-modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
-modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=

grafana/alerting-rules.yaml

@@ -1,220 +0,0 @@
-# DBBackup Prometheus Alerting Rules
-# Deploy these to your Prometheus server or use Grafana Alerting
-#
-# Usage with Prometheus:
-#   Add to prometheus.yml:
-#     rule_files:
-#       - /path/to/alerting-rules.yaml
-#
-# Usage with Grafana Alerting:
-#   Import these as Grafana alert rules via the UI or provisioning
-
-groups:
-  - name: dbbackup_alerts
-    interval: 1m
-    rules:
-      # Critical: No backup in 24 hours
-      - alert: DBBackupRPOCritical
-        expr: dbbackup_rpo_seconds > 86400
-        for: 5m
-        labels:
-          severity: critical
-        annotations:
-          summary: "No backup for {{ $labels.database }} in 24+ hours"
-          description: |
-            Database {{ $labels.database }} on {{ $labels.server }} has not been
-            backed up in {{ $value | humanizeDuration }}. This exceeds the 24-hour
-            RPO threshold. Immediate investigation required.
-          runbook_url: "https://github.com/your-org/dbbackup/wiki/Runbooks#rpo-critical"
-
-      # Warning: No backup in 12 hours
-      - alert: DBBackupRPOWarning
-        expr: dbbackup_rpo_seconds > 43200 and dbbackup_rpo_seconds <= 86400
-        for: 5m
-        labels:
-          severity: warning
-        annotations:
-          summary: "No backup for {{ $labels.database }} in 12+ hours"
-          description: |
-            Database {{ $labels.database }} on {{ $labels.server }} has not been
-            backed up in {{ $value | humanizeDuration }}. Check backup schedule.
-          runbook_url: "https://github.com/your-org/dbbackup/wiki/Runbooks#rpo-warning"
-
-      # Critical: Backup failures detected
-      - alert: DBBackupFailure
-        expr: increase(dbbackup_backup_total{status="failure"}[1h]) > 0
-        for: 1m
-        labels:
-          severity: critical
-        annotations:
-          summary: "Backup failure detected for {{ $labels.database }}"
-          description: |
-            One or more backup attempts failed for {{ $labels.database }} on
-            {{ $labels.server }} in the last hour. Check logs for details.
-          runbook_url: "https://github.com/your-org/dbbackup/wiki/Runbooks#backup-failure"
-
-      # Warning: Backup not verified
-      - alert: DBBackupNotVerified
-        expr: dbbackup_backup_verified == 0
-        for: 24h
-        labels:
-          severity: warning
-        annotations:
-          summary: "Backup for {{ $labels.database }} not verified"
-          description: |
-            The latest backup for {{ $labels.database }} on {{ $labels.server }}
-            has not been verified. Consider running verification to ensure
-            backup integrity.
-          runbook_url: "https://github.com/your-org/dbbackup/wiki/Runbooks#verification"
-
-      # Warning: Dedup ratio dropping
-      - alert: DBBackupDedupRatioLow
-        expr: dbbackup_dedup_ratio < 0.1
-        for: 1h
-        labels:
-          severity: warning
-        annotations:
-          summary: "Low deduplication ratio on {{ $labels.server }}"
-          description: |
-            Deduplication ratio on {{ $labels.server }} is {{ $value | printf "%.1f%%" }}.
-            This may indicate changes in data patterns or dedup configuration issues.
-          runbook_url: "https://github.com/your-org/dbbackup/wiki/Runbooks#dedup-low"
-
-      # Warning: Dedup disk usage growing rapidly
-      - alert: DBBackupDedupDiskGrowth
-        expr: |
-          predict_linear(dbbackup_dedup_disk_usage_bytes[7d], 30*24*3600) > 
-          (dbbackup_dedup_disk_usage_bytes * 2)
-        for: 1h
-        labels:
-          severity: warning
-        annotations:
-          summary: "Rapid dedup storage growth on {{ $labels.server }}"
-          description: |
-            Dedup storage on {{ $labels.server }} is growing rapidly.
-            At current rate, usage will double in 30 days.
-            Current usage: {{ $value | humanize1024 }}B
-          runbook_url: "https://github.com/your-org/dbbackup/wiki/Runbooks#storage-growth"
-
-      # PITR: Archive lag high
-      - alert: DBBackupPITRArchiveLag
-        expr: dbbackup_pitr_archive_lag_seconds > 600
-        for: 5m
-        labels:
-          severity: warning
-        annotations:
-          summary: "PITR archive lag high for {{ $labels.database }}"
-          description: |
-            WAL/binlog archiving for {{ $labels.database }} on {{ $labels.server }}
-            is {{ $value | humanizeDuration }} behind. This reduces the PITR
-            recovery point. Check archive process and disk space.
-          runbook_url: "https://github.com/your-org/dbbackup/wiki/Runbooks#pitr-archive-lag"
-
-      # PITR: Archive lag critical
-      - alert: DBBackupPITRArchiveLagCritical
-        expr: dbbackup_pitr_archive_lag_seconds > 1800
-        for: 5m
-        labels:
-          severity: critical
-        annotations:
-          summary: "PITR archive severely behind for {{ $labels.database }}"
-          description: |
-            WAL/binlog archiving for {{ $labels.database }} is {{ $value | humanizeDuration }}
-            behind. Point-in-time recovery capability is at risk. Immediate action required.
-          runbook_url: "https://github.com/your-org/dbbackup/wiki/Runbooks#pitr-archive-critical"
-
-      # PITR: Chain broken (gaps detected)
-      - alert: DBBackupPITRChainBroken
-        expr: dbbackup_pitr_chain_valid == 0
-        for: 1m
-        labels:
-          severity: critical
-        annotations:
-          summary: "PITR chain broken for {{ $labels.database }}"
-          description: |
-            The WAL/binlog chain for {{ $labels.database }} on {{ $labels.server }}
-            has gaps. Point-in-time recovery to arbitrary points is NOT possible.
-            A new base backup is required to restore PITR capability.
-          runbook_url: "https://github.com/your-org/dbbackup/wiki/Runbooks#pitr-chain-broken"
-
-      # PITR: Gaps in chain
-      - alert: DBBackupPITRGapsDetected
-        expr: dbbackup_pitr_gap_count > 0
-        for: 5m
-        labels:
-          severity: warning
-        annotations:
-          summary: "PITR chain has {{ $value }} gaps for {{ $labels.database }}"
-          description: |
-            {{ $value }} gaps detected in WAL/binlog chain for {{ $labels.database }}.
-            Recovery to points within gaps will fail. Consider taking a new base backup.
-          runbook_url: "https://github.com/your-org/dbbackup/wiki/Runbooks#pitr-gaps"
-
-      # PITR: Unexpectedly disabled
-      - alert: DBBackupPITRDisabled
-        expr: |
-          dbbackup_pitr_enabled == 0 
-          and on(database) dbbackup_pitr_archive_count > 0
-        for: 10m
-        labels:
-          severity: critical
-        annotations:
-          summary: "PITR unexpectedly disabled for {{ $labels.database }}"
-          description: |
-            PITR was previously enabled for {{ $labels.database }} (has archived logs)
-            but is now disabled. This may indicate a configuration issue or
-            database restart without PITR settings.
-          runbook_url: "https://github.com/your-org/dbbackup/wiki/Runbooks#pitr-disabled"
-
-      # Backup type: No full backups recently
-      - alert: DBBackupNoRecentFullBackup
-        expr: |
-          time() - dbbackup_last_success_timestamp{backup_type="full"} > 604800
-        for: 1h
-        labels:
-          severity: warning
-        annotations:
-          summary: "No full backup in 7+ days for {{ $labels.database }}"
-          description: |
-            Database {{ $labels.database }} has not had a full backup in over 7 days.
-            Incremental backups depend on a valid full backup base.
-          runbook_url: "https://github.com/your-org/dbbackup/wiki/Runbooks#no-full-backup"
-
-      # Info: Exporter not responding
-      - alert: DBBackupExporterDown
-        expr: up{job="dbbackup"} == 0
-        for: 5m
-        labels:
-          severity: warning
-        annotations:
-          summary: "DBBackup exporter is down on {{ $labels.instance }}"
-          description: |
-            The DBBackup Prometheus exporter on {{ $labels.instance }} is not
-            responding. Metrics collection is affected.
-          runbook_url: "https://github.com/your-org/dbbackup/wiki/Runbooks#exporter-down"
-
-      # Info: Metrics stale (scrape timestamp old)
-      - alert: DBBackupMetricsStale
-        expr: time() - dbbackup_scrape_timestamp > 600
-        for: 5m
-        labels:
-          severity: warning
-        annotations:
-          summary: "DBBackup metrics are stale on {{ $labels.server }}"
-          description: |
-            Metrics for {{ $labels.server }} haven't been updated in
-            {{ $value | humanizeDuration }}. The exporter may be having issues.
-          runbook_url: "https://github.com/your-org/dbbackup/wiki/Runbooks#metrics-stale"
-
-      # Critical: No successful backups ever
-      - alert: DBBackupNeverSucceeded
-        expr: dbbackup_backup_total{status="success"} == 0
-        for: 1h
-        labels:
-          severity: critical
-        annotations:
-          summary: "No successful backups for {{ $labels.database }}"
-          description: |
-            Database {{ $labels.database }} on {{ $labels.server }} has never
-            had a successful backup. This requires immediate attention.
-          runbook_url: "https://github.com/your-org/dbbackup/wiki/Runbooks#never-succeeded"

grafana/dbbackup-dashboard.json

@@ -1,1588 +0,0 @@
-{
-  "annotations": {
-    "list": [
-      {
-        "builtIn": 1,
-        "datasource": {
-          "type": "grafana",
-          "uid": "-- Grafana --"
-        },
-        "enable": true,
-        "hide": true,
-        "iconColor": "rgba(0, 211, 255, 1)",
-        "name": "Annotations & Alerts",
-        "type": "dashboard"
-      }
-    ]
-  },
-  "description": "Comprehensive monitoring dashboard for DBBackup - tracks backup status, RPO, deduplication, and verification across all database servers.",
-  "editable": true,
-  "fiscalYearStartMonth": 0,
-  "graphTooltip": 1,
-  "id": null,
-  "links": [],
-  "liveNow": false,
-  "panels": [
-    {
-      "collapsed": false,
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 0
-      },
-      "id": 200,
-      "panels": [],
-      "title": "Backup Overview",
-      "type": "row"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Shows SUCCESS if RPO is under 7 days, FAILED otherwise. Green = healthy backup schedule.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [
-            {
-              "options": {
-                "0": {
-                  "color": "red",
-                  "index": 1,
-                  "text": "FAILED"
-                },
-                "1": {
-                  "color": "green",
-                  "index": 0,
-                  "text": "SUCCESS"
-                }
-              },
-              "type": "value"
-            }
-          ],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "red",
-                "value": null
-              },
-              {
-                "color": "green",
-                "value": 1
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 5,
-        "x": 0,
-        "y": 1
-      },
-      "id": 1,
-      "options": {
-        "colorMode": "background",
-        "graphMode": "none",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto"
-      },
-      "pluginVersion": "10.2.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_rpo_seconds{server=~\"$server\"} < bool 604800",
-          "legendFormat": "{{database}}",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Last Backup Status",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Time elapsed since the last successful backup. Green < 12h, Yellow < 24h, Red > 24h.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "yellow",
-                "value": 43200
-              },
-              {
-                "color": "red",
-                "value": 86400
-              }
-            ]
-          },
-          "unit": "s"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 5,
-        "x": 5,
-        "y": 1
-      },
-      "id": 2,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "area",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto"
-      },
-      "pluginVersion": "10.2.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_rpo_seconds{server=~\"$server\"}",
-          "legendFormat": "{{database}}",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Time Since Last Backup",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Whether the most recent backup was verified successfully. 1 = verified and valid.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [
-            {
-              "options": {
-                "0": {
-                  "color": "orange",
-                  "index": 1,
-                  "text": "NOT VERIFIED"
-                },
-                "1": {
-                  "color": "green",
-                  "index": 0,
-                  "text": "VERIFIED"
-                }
-              },
-              "type": "value"
-            }
-          ],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "orange",
-                "value": null
-              },
-              {
-                "color": "green",
-                "value": 1
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 5,
-        "x": 10,
-        "y": 1
-      },
-      "id": 9,
-      "options": {
-        "colorMode": "background",
-        "graphMode": "none",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto"
-      },
-      "pluginVersion": "10.2.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_backup_verified{server=~\"$server\"}",
-          "legendFormat": "{{database}}",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Verification Status",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Total count of successful backup completions.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 4,
-        "x": 15,
-        "y": 1
-      },
-      "id": 3,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "none",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto"
-      },
-      "pluginVersion": "10.2.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_backup_total{server=~\"$server\", status=\"success\"}",
-          "legendFormat": "{{database}}",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Total Successful Backups",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Total count of failed backup attempts. Any value > 0 warrants investigation.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 1
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 5,
-        "x": 19,
-        "y": 1
-      },
-      "id": 4,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "none",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto"
-      },
-      "pluginVersion": "10.2.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_backup_total{server=~\"$server\", status=\"failure\"}",
-          "legendFormat": "{{database}}",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Total Failed Backups",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Recovery Point Objective over time. Shows how long since the last successful backup. Red line at 24h threshold.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "auto",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "line"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 86400
-              }
-            ]
-          },
-          "unit": "s"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 5
-      },
-      "id": 5,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_rpo_seconds{server=~\"$server\"}",
-          "legendFormat": "{{server}} - {{database}}",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "RPO Over Time",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Size of each backup over time. Useful for capacity planning and detecting unexpected growth.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "drawStyle": "bars",
-            "fillOpacity": 100,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              }
-            ]
-          },
-          "unit": "bytes"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 5
-      },
-      "id": 6,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_last_backup_size_bytes{server=~\"$server\"}",
-          "legendFormat": "{{server}} - {{database}}",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Backup Size",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "How long each backup takes. Monitor for trends that may indicate database growth or performance issues.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "auto",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              }
-            ]
-          },
-          "unit": "s"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 13
-      },
-      "id": 7,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_last_backup_duration_seconds{server=~\"$server\"}",
-          "legendFormat": "{{server}} - {{database}}",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Backup Duration",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Summary table showing current status of all databases with color-coded RPO and backup sizes.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "custom": {
-            "align": "auto",
-            "cellOptions": {
-              "type": "auto"
-            },
-            "inspect": false
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              }
-            ]
-          }
-        },
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "Status"
-            },
-            "properties": [
-              {
-                "id": "mappings",
-                "value": [
-                  {
-                    "options": {
-                      "0": {
-                        "color": "red",
-                        "index": 1,
-                        "text": "FAILED"
-                      },
-                      "1": {
-                        "color": "green",
-                        "index": 0,
-                        "text": "SUCCESS"
-                      }
-                    },
-                    "type": "value"
-                  }
-                ]
-              },
-              {
-                "id": "custom.cellOptions",
-                "value": {
-                  "mode": "basic",
-                  "type": "color-background"
-                }
-              }
-            ]
-          },
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "RPO"
-            },
-            "properties": [
-              {
-                "id": "unit",
-                "value": "s"
-              },
-              {
-                "id": "thresholds",
-                "value": {
-                  "mode": "absolute",
-                  "steps": [
-                    {
-                      "color": "green",
-                      "value": null
-                    },
-                    {
-                      "color": "yellow",
-                      "value": 43200
-                    },
-                    {
-                      "color": "red",
-                      "value": 86400
-                    }
-                  ]
-                }
-              },
-              {
-                "id": "custom.cellOptions",
-                "value": {
-                  "mode": "basic",
-                  "type": "color-background"
-                }
-              }
-            ]
-          },
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "Size"
-            },
-            "properties": [
-              {
-                "id": "unit",
-                "value": "bytes"
-              }
-            ]
-          }
-        ]
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 13
-      },
-      "id": 8,
-      "options": {
-        "cellHeight": "sm",
-        "footer": {
-          "countRows": false,
-          "fields": "",
-          "reducer": [
-            "sum"
-          ],
-          "show": false
-        },
-        "showHeader": true
-      },
-      "pluginVersion": "10.2.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_rpo_seconds{server=~\"$server\"}",
-          "format": "table",
-          "hide": false,
-          "instant": true,
-          "legendFormat": "__auto",
-          "range": false,
-          "refId": "RPO"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_last_backup_size_bytes{server=~\"$server\"}",
-          "format": "table",
-          "hide": false,
-          "instant": true,
-          "legendFormat": "__auto",
-          "range": false,
-          "refId": "Size"
-        }
-      ],
-      "title": "Backup Status Overview",
-      "transformations": [
-        {
-          "id": "joinByField",
-          "options": {
-            "byField": "database",
-            "mode": "outer"
-          }
-        },
-        {
-          "id": "organize",
-          "options": {
-            "excludeByName": {
-              "Time": true,
-              "Time 1": true,
-              "Time 2": true,
-              "__name__": true,
-              "__name__ 1": true,
-              "__name__ 2": true,
-              "instance 1": true,
-              "instance 2": true,
-              "job": true,
-              "job 1": true,
-              "job 2": true,
-              "engine 1": true,
-              "engine 2": true
-            },
-            "indexByName": {
-              "Database": 0,
-              "Instance": 1,
-              "Engine": 2,
-              "RPO": 3,
-              "Size": 4
-            },
-            "renameByName": {
-              "Value #RPO": "RPO",
-              "Value #Size": "Size",
-              "database": "Database",
-              "instance": "Instance",
-              "engine": "Engine"
-            }
-          }
-        }
-      ],
-      "type": "table"
-    },
-    {
-      "collapsed": false,
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 21
-      },
-      "id": 100,
-      "panels": [],
-      "title": "Deduplication Statistics",
-      "type": "row"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Overall deduplication efficiency (0-1). Higher values mean more duplicate data eliminated. 0.5 = 50% space savings.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "blue",
-                "value": null
-              }
-            ]
-          },
-          "unit": "percentunit"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 6,
-        "x": 0,
-        "y": 22
-      },
-      "id": 101,
-      "options": {
-        "colorMode": "background",
-        "graphMode": "none",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": ["lastNotNull"],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto"
-      },
-      "pluginVersion": "10.2.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_dedup_ratio{server=~\"$server\"}",
-          "legendFormat": "__auto",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Dedup Ratio",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Total bytes saved by deduplication across all backups.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              }
-            ]
-          },
-          "unit": "bytes"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 6,
-        "x": 6,
-        "y": 22
-      },
-      "id": 102,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "none",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": ["lastNotNull"],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto"
-      },
-      "pluginVersion": "10.2.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_dedup_space_saved_bytes{server=~\"$server\"}",
-          "legendFormat": "__auto",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Space Saved",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Actual disk usage of the chunk store after deduplication.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "yellow",
-                "value": null
-              }
-            ]
-          },
-          "unit": "bytes"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 6,
-        "x": 12,
-        "y": 22
-      },
-      "id": 103,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "none",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": ["lastNotNull"],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto"
-      },
-      "pluginVersion": "10.2.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_dedup_disk_usage_bytes{server=~\"$server\"}",
-          "legendFormat": "__auto",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Disk Usage",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Total number of unique content-addressed chunks in the dedup store.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "purple",
-                "value": null
-              }
-            ]
-          },
-          "unit": "short"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 6,
-        "x": 18,
-        "y": 22
-      },
-      "id": 104,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "none",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": ["lastNotNull"],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto"
-      },
-      "pluginVersion": "10.2.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_dedup_chunks_total{server=~\"$server\"}",
-          "legendFormat": "__auto",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Total Chunks",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Compression ratio achieved (0-1). Higher = better compression of chunk data.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "orange",
-                "value": null
-              }
-            ]
-          },
-          "unit": "percentunit"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 4,
-        "x": 0,
-        "y": 27
-      },
-      "id": 107,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "none",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": ["lastNotNull"],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto"
-      },
-      "pluginVersion": "10.2.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_dedup_compression_ratio{server=~\"$server\"}",
-          "legendFormat": "__auto",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Compression Ratio",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Timestamp of the oldest chunk - useful for monitoring retention policy.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "semi-dark-blue",
-                "value": null
-              }
-            ]
-          },
-          "unit": "dateTimeFromNow"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 4,
-        "x": 4,
-        "y": 27
-      },
-      "id": 108,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "none",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": ["lastNotNull"],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto"
-      },
-      "pluginVersion": "10.2.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_dedup_oldest_chunk_timestamp{server=~\"$server\"} * 1000",
-          "legendFormat": "__auto",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Oldest Chunk",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Timestamp of the newest chunk - confirms dedup is working on recent backups.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "semi-dark-green",
-                "value": null
-              }
-            ]
-          },
-          "unit": "dateTimeFromNow"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 4,
-        "x": 8,
-        "y": 27
-      },
-      "id": 109,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "none",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calcs": ["lastNotNull"],
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto"
-      },
-      "pluginVersion": "10.2.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_dedup_newest_chunk_timestamp{server=~\"$server\"} * 1000",
-          "legendFormat": "__auto",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Newest Chunk",
-      "type": "stat"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Per-database deduplication efficiency over time. Compare databases to identify which benefit most from dedup.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "auto",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              }
-            ]
-          },
-          "unit": "percentunit"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 32
-      },
-      "id": 105,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "10.2.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_dedup_database_ratio{server=~\"$server\"}",
-          "legendFormat": "{{database}}",
-          "range": true,
-          "refId": "A"
-        }
-      ],
-      "title": "Dedup Ratio by Database",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${DS_PROMETHEUS}"
-      },
-      "description": "Storage trends: compare space saved by dedup vs actual disk usage over time.",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "auto",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              }
-            ]
-          },
-          "unit": "bytes"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 32
-      },
-      "id": 106,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "10.2.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_dedup_space_saved_bytes{server=~\"$server\"}",
-          "legendFormat": "Space Saved",
-          "range": true,
-          "refId": "A"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${DS_PROMETHEUS}"
-          },
-          "editorMode": "code",
-          "expr": "dbbackup_dedup_disk_usage_bytes{server=~\"$server\"}",
-          "legendFormat": "Disk Usage",
-          "range": true,
-          "refId": "B"
-        }
-      ],
-      "title": "Dedup Storage Over Time",
-      "type": "timeseries"
-    }
-  ],
-  "refresh": "30s",
-  "schemaVersion": 38,
-  "tags": [
-    "dbbackup",
-    "backup",
-    "database",
-    "dedup",
-    "monitoring"
-  ],
-  "templating": {
-    "list": [
-      {
-        "current": {
-          "selected": false,
-          "text": "All",
-          "value": "$__all"
-        },
-        "datasource": {
-          "type": "prometheus",
-          "uid": "${DS_PROMETHEUS}"
-        },
-        "definition": "label_values(dbbackup_rpo_seconds, server)",
-        "hide": 0,
-        "includeAll": true,
-        "label": "Server",
-        "multi": true,
-        "name": "server",
-        "options": [],
-        "query": {
-          "query": "label_values(dbbackup_rpo_seconds, server)",
-          "refId": "StandardVariableQuery"
-        },
-        "refresh": 2,
-        "regex": "",
-        "skipUrlSync": false,
-        "sort": 1,
-        "type": "query"
-      },
-      {
-        "hide": 2,
-        "name": "DS_PROMETHEUS",
-        "query": "prometheus",
-        "skipUrlSync": false,
-        "type": "datasource"
-      }
-    ]
-  },
-  "time": {
-    "from": "now-24h",
-    "to": "now"
-  },
-  "timepicker": {},
-  "timezone": "",
-  "title": "DBBackup Overview",
-  "uid": "dbbackup-overview",
-  "version": 1,
-  "weekStart": ""
-}

internal/auth/helper.go

@@ -84,13 +84,19 @@ func findHbaFileViaPostgres() string {
 
 // parsePgHbaConf parses pg_hba.conf and returns the authentication method
 func parsePgHbaConf(path string, user string) AuthMethod {
-	// Try to read the file directly - do NOT use sudo as it triggers password prompts
-	// If we can't read pg_hba.conf, we'll rely on connection attempts to determine auth
+	// Try with sudo if we can't read directly
 	file, err := os.Open(path)
 	if err != nil {
-		// If we can't read the file, return unknown and let the connection determine auth
-		// This avoids sudo password prompts when running as postgres via su
-		return AuthUnknown
+		// Try with sudo (with timeout)
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+
+		cmd := exec.CommandContext(ctx, "sudo", "cat", path)
+		output, err := cmd.Output()
+		if err != nil {
+			return AuthUnknown
+		}
+		return parseHbaContent(string(output), user)
 	}
 	defer file.Close()
 
@@ -201,12 +207,12 @@ func buildAuthMismatchMessage(osUser, dbUser string, method AuthMethod) string {
 	msg.WriteString("\n[WARN]  Authentication Mismatch Detected\n")
 	msg.WriteString(strings.Repeat("=", 60) + "\n\n")
 
-	msg.WriteString("   PostgreSQL is using '" + string(method) + "' authentication\n")
-	msg.WriteString("   OS user '" + osUser + "' cannot authenticate as DB user '" + dbUser + "'\n\n")
+	msg.WriteString(fmt.Sprintf("   PostgreSQL is using '%s' authentication\n", method))
+	msg.WriteString(fmt.Sprintf("   OS user '%s' cannot authenticate as DB user '%s'\n\n", osUser, dbUser))
 
 	msg.WriteString("[TIP] Solutions (choose one):\n\n")
 
-	msg.WriteString("   1. Run as matching user:\n")
+	msg.WriteString(fmt.Sprintf("   1. Run as matching user:\n"))
 	msg.WriteString(fmt.Sprintf("      sudo -u %s %s\n\n", dbUser, getCommandLine()))
 
 	msg.WriteString("   2. Configure ~/.pgpass file (recommended):\n")
@@ -214,11 +220,11 @@ func buildAuthMismatchMessage(osUser, dbUser string, method AuthMethod) string {
 	msg.WriteString("      chmod 0600 ~/.pgpass\n\n")
 
 	msg.WriteString("   3. Set PGPASSWORD environment variable:\n")
-	msg.WriteString("      export PGPASSWORD=your_password\n")
-	msg.WriteString("      " + getCommandLine() + "\n\n")
+	msg.WriteString(fmt.Sprintf("      export PGPASSWORD=your_password\n"))
+	msg.WriteString(fmt.Sprintf("      %s\n\n", getCommandLine()))
 
 	msg.WriteString("   4. Provide password via flag:\n")
-	msg.WriteString("      " + getCommandLine() + " --password your_password\n\n")
+	msg.WriteString(fmt.Sprintf("      %s --password your_password\n\n", getCommandLine()))
 
 	msg.WriteString("[NOTE] Note: For production use, ~/.pgpass or PGPASSWORD are recommended\n")
 	msg.WriteString("         to avoid exposing passwords in command history.\n\n")

internal/backup/engine.go

@@ -10,7 +10,6 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"runtime"
 	"strconv"
 	"strings"
 	"sync"
@@ -21,33 +20,22 @@ import (
 	"dbbackup/internal/cloud"
 	"dbbackup/internal/config"
 	"dbbackup/internal/database"
-	"dbbackup/internal/fs"
 	"dbbackup/internal/logger"
 	"dbbackup/internal/metadata"
 	"dbbackup/internal/metrics"
 	"dbbackup/internal/progress"
 	"dbbackup/internal/security"
 	"dbbackup/internal/swap"
-
-	"github.com/klauspost/pgzip"
 )
 
-// ProgressCallback is called with byte-level progress updates during backup operations
-type ProgressCallback func(current, total int64, description string)
-
-// DatabaseProgressCallback is called with database count progress during cluster backup
-type DatabaseProgressCallback func(done, total int, dbName string)
-
 // Engine handles backup operations
 type Engine struct {
-	cfg                *config.Config
-	log                logger.Logger
-	db                 database.Database
-	progress           progress.Indicator
-	detailedReporter   *progress.DetailedReporter
-	silent             bool // Silent mode for TUI
-	progressCallback   ProgressCallback
-	dbProgressCallback DatabaseProgressCallback
+	cfg              *config.Config
+	log              logger.Logger
+	db               database.Database
+	progress         progress.Indicator
+	detailedReporter *progress.DetailedReporter
+	silent           bool // Silent mode for TUI
 }
 
 // New creates a new backup engine
@@ -98,23 +86,6 @@ func NewSilent(cfg *config.Config, log logger.Logger, db database.Database, prog
 	}
 }
 
-// SetProgressCallback sets a callback for detailed progress reporting (for TUI mode)
-func (e *Engine) SetProgressCallback(cb ProgressCallback) {
-	e.progressCallback = cb
-}
-
-// SetDatabaseProgressCallback sets a callback for database count progress during cluster backup
-func (e *Engine) SetDatabaseProgressCallback(cb DatabaseProgressCallback) {
-	e.dbProgressCallback = cb
-}
-
-// reportDatabaseProgress reports database count progress to the callback if set
-func (e *Engine) reportDatabaseProgress(done, total int, dbName string) {
-	if e.dbProgressCallback != nil {
-		e.dbProgressCallback(done, total, dbName)
-	}
-}
-
 // loggerAdapter adapts our logger to the progress.Logger interface
 type loggerAdapter struct {
 	logger logger.Logger
@@ -494,8 +465,6 @@ func (e *Engine) BackupCluster(ctx context.Context) error {
 			estimator.UpdateProgress(idx)
 			e.printf("   [%d/%d] Backing up database: %s\n", idx+1, len(databases), name)
 			quietProgress.Update(fmt.Sprintf("Backing up database %d/%d: %s", idx+1, len(databases), name))
-			// Report database progress to TUI callback
-			e.reportDatabaseProgress(idx+1, len(databases), name)
 			mu.Unlock()
 
 			// Check database size and warn if very large
@@ -710,7 +679,6 @@ func (e *Engine) monitorCommandProgress(stderr io.ReadCloser, tracker *progress.
 }
 
 // executeMySQLWithProgressAndCompression handles MySQL backup with compression and progress
-// Uses in-process pgzip for parallel compression (2-4x faster on multi-core systems)
 func (e *Engine) executeMySQLWithProgressAndCompression(ctx context.Context, cmdArgs []string, outputFile string, tracker *progress.OperationTracker) error {
 	// Create mysqldump command
 	dumpCmd := exec.CommandContext(ctx, cmdArgs[0], cmdArgs[1:]...)
@@ -719,6 +687,9 @@ func (e *Engine) executeMySQLWithProgressAndCompression(ctx context.Context, cmd
 		dumpCmd.Env = append(dumpCmd.Env, "MYSQL_PWD="+e.cfg.Password)
 	}
 
+	// Create gzip command
+	gzipCmd := exec.CommandContext(ctx, "gzip", fmt.Sprintf("-%d", e.cfg.CompressionLevel))
+
 	// Create output file
 	outFile, err := os.Create(outputFile)
 	if err != nil {
@@ -726,19 +697,15 @@ func (e *Engine) executeMySQLWithProgressAndCompression(ctx context.Context, cmd
 	}
 	defer outFile.Close()
 
-	// Create parallel gzip writer using pgzip
-	gzWriter, err := fs.NewParallelGzipWriter(outFile, e.cfg.CompressionLevel)
-	if err != nil {
-		return fmt.Errorf("failed to create gzip writer: %w", err)
-	}
-	defer gzWriter.Close()
-
-	// Set up pipeline: mysqldump stdout -> pgzip writer -> file
+	// Set up pipeline: mysqldump | gzip > outputfile
 	pipe, err := dumpCmd.StdoutPipe()
 	if err != nil {
 		return fmt.Errorf("failed to create pipe: %w", err)
 	}
 
+	gzipCmd.Stdin = pipe
+	gzipCmd.Stdout = outFile
+
 	// Get stderr for progress monitoring
 	stderr, err := dumpCmd.StderrPipe()
 	if err != nil {
@@ -752,17 +719,15 @@ func (e *Engine) executeMySQLWithProgressAndCompression(ctx context.Context, cmd
 		e.monitorCommandProgress(stderr, tracker)
 	}()
 
-	// Start mysqldump
-	if err := dumpCmd.Start(); err != nil {
-		return fmt.Errorf("failed to start mysqldump: %w", err)
+	// Start both commands
+	if err := gzipCmd.Start(); err != nil {
+		return fmt.Errorf("failed to start gzip: %w", err)
 	}
 
-	// Copy mysqldump output through pgzip in a goroutine
-	copyDone := make(chan error, 1)
-	go func() {
-		_, err := io.Copy(gzWriter, pipe)
-		copyDone <- err
-	}()
+	if err := dumpCmd.Start(); err != nil {
+		gzipCmd.Process.Kill()
+		return fmt.Errorf("failed to start mysqldump: %w", err)
+	}
 
 	// Wait for mysqldump with context handling
 	dumpDone := make(chan error, 1)
@@ -777,6 +742,7 @@ func (e *Engine) executeMySQLWithProgressAndCompression(ctx context.Context, cmd
 	case <-ctx.Done():
 		e.log.Warn("Backup cancelled - killing mysqldump")
 		dumpCmd.Process.Kill()
+		gzipCmd.Process.Kill()
 		<-dumpDone
 		return ctx.Err()
 	}
@@ -784,14 +750,10 @@ func (e *Engine) executeMySQLWithProgressAndCompression(ctx context.Context, cmd
 	// Wait for stderr reader
 	<-stderrDone
 
-	// Wait for copy to complete
-	if copyErr := <-copyDone; copyErr != nil {
-		return fmt.Errorf("compression failed: %w", copyErr)
-	}
-
-	// Close gzip writer to flush all data
-	if err := gzWriter.Close(); err != nil {
-		return fmt.Errorf("failed to close gzip writer: %w", err)
+	// Close pipe and wait for gzip
+	pipe.Close()
+	if err := gzipCmd.Wait(); err != nil {
+		return fmt.Errorf("gzip failed: %w", err)
 	}
 
 	if dumpErr != nil {
@@ -802,7 +764,6 @@ func (e *Engine) executeMySQLWithProgressAndCompression(ctx context.Context, cmd
 }
 
 // executeMySQLWithCompression handles MySQL backup with compression
-// Uses in-process pgzip for parallel compression (2-4x faster on multi-core systems)
 func (e *Engine) executeMySQLWithCompression(ctx context.Context, cmdArgs []string, outputFile string) error {
 	// Create mysqldump command
 	dumpCmd := exec.CommandContext(ctx, cmdArgs[0], cmdArgs[1:]...)
@@ -811,6 +772,9 @@ func (e *Engine) executeMySQLWithCompression(ctx context.Context, cmdArgs []stri
 		dumpCmd.Env = append(dumpCmd.Env, "MYSQL_PWD="+e.cfg.Password)
 	}
 
+	// Create gzip command
+	gzipCmd := exec.CommandContext(ctx, "gzip", fmt.Sprintf("-%d", e.cfg.CompressionLevel))
+
 	// Create output file
 	outFile, err := os.Create(outputFile)
 	if err != nil {
@@ -818,31 +782,25 @@ func (e *Engine) executeMySQLWithCompression(ctx context.Context, cmdArgs []stri
 	}
 	defer outFile.Close()
 
-	// Create parallel gzip writer using pgzip
-	gzWriter, err := fs.NewParallelGzipWriter(outFile, e.cfg.CompressionLevel)
-	if err != nil {
-		return fmt.Errorf("failed to create gzip writer: %w", err)
-	}
-	defer gzWriter.Close()
-
-	// Set up pipeline: mysqldump stdout -> pgzip writer -> file
-	pipe, err := dumpCmd.StdoutPipe()
+	// Set up pipeline: mysqldump | gzip > outputfile
+	stdin, err := dumpCmd.StdoutPipe()
 	if err != nil {
 		return fmt.Errorf("failed to create pipe: %w", err)
 	}
+	gzipCmd.Stdin = stdin
+	gzipCmd.Stdout = outFile
+
+	// Start gzip first
+	if err := gzipCmd.Start(); err != nil {
+		return fmt.Errorf("failed to start gzip: %w", err)
+	}
 
 	// Start mysqldump
 	if err := dumpCmd.Start(); err != nil {
+		gzipCmd.Process.Kill()
 		return fmt.Errorf("failed to start mysqldump: %w", err)
 	}
 
-	// Copy mysqldump output through pgzip in a goroutine
-	copyDone := make(chan error, 1)
-	go func() {
-		_, err := io.Copy(gzWriter, pipe)
-		copyDone <- err
-	}()
-
 	// Wait for mysqldump with context handling
 	dumpDone := make(chan error, 1)
 	go func() {
@@ -856,18 +814,15 @@ func (e *Engine) executeMySQLWithCompression(ctx context.Context, cmdArgs []stri
 	case <-ctx.Done():
 		e.log.Warn("Backup cancelled - killing mysqldump")
 		dumpCmd.Process.Kill()
+		gzipCmd.Process.Kill()
 		<-dumpDone
 		return ctx.Err()
 	}
 
-	// Wait for copy to complete
-	if copyErr := <-copyDone; copyErr != nil {
-		return fmt.Errorf("compression failed: %w", copyErr)
-	}
-
-	// Close gzip writer to flush all data
-	if err := gzWriter.Close(); err != nil {
-		return fmt.Errorf("failed to close gzip writer: %w", err)
+	// Close pipe and wait for gzip
+	stdin.Close()
+	if err := gzipCmd.Wait(); err != nil {
+		return fmt.Errorf("gzip failed: %w", err)
 	}
 
 	if dumpErr != nil {
@@ -948,89 +903,136 @@ func (e *Engine) createSampleBackup(ctx context.Context, databaseName, outputFil
 func (e *Engine) backupGlobals(ctx context.Context, tempDir string) error {
 	globalsFile := filepath.Join(tempDir, "globals.sql")
 
-	// CRITICAL: Always pass port even for localhost - user may have non-standard port
-	cmd := exec.CommandContext(ctx, "pg_dumpall", "--globals-only",
-		"-p", fmt.Sprintf("%d", e.cfg.Port),
-		"-U", e.cfg.User)
-
-	// Only add -h flag for non-localhost to use Unix socket for peer auth
-	if e.cfg.Host != "localhost" && e.cfg.Host != "127.0.0.1" && e.cfg.Host != "" {
-		cmd.Args = append([]string{cmd.Args[0], "-h", e.cfg.Host}, cmd.Args[1:]...)
+	cmd := exec.CommandContext(ctx, "pg_dumpall", "--globals-only")
+	if e.cfg.Host != "localhost" {
+		cmd.Args = append(cmd.Args, "-h", e.cfg.Host, "-p", fmt.Sprintf("%d", e.cfg.Port))
 	}
+	cmd.Args = append(cmd.Args, "-U", e.cfg.User)
 
 	cmd.Env = os.Environ()
 	if e.cfg.Password != "" {
 		cmd.Env = append(cmd.Env, "PGPASSWORD="+e.cfg.Password)
 	}
 
-	// Use Start/Wait pattern for proper Ctrl+C handling
-	stdout, err := cmd.StdoutPipe()
+	output, err := cmd.Output()
 	if err != nil {
-		return fmt.Errorf("failed to create stdout pipe: %w", err)
-	}
-
-	if err := cmd.Start(); err != nil {
-		return fmt.Errorf("failed to start pg_dumpall: %w", err)
-	}
-
-	// Read output in goroutine
-	var output []byte
-	var readErr error
-	readDone := make(chan struct{})
-	go func() {
-		defer close(readDone)
-		output, readErr = io.ReadAll(stdout)
-	}()
-
-	// Wait for command with proper context handling
-	cmdDone := make(chan error, 1)
-	go func() {
-		cmdDone <- cmd.Wait()
-	}()
-
-	var cmdErr error
-	select {
-	case cmdErr = <-cmdDone:
-		// Command completed normally
-	case <-ctx.Done():
-		e.log.Warn("Globals backup cancelled - killing pg_dumpall")
-		cmd.Process.Kill()
-		<-cmdDone
-		return ctx.Err()
-	}
-
-	<-readDone
-
-	if cmdErr != nil {
-		return fmt.Errorf("pg_dumpall failed: %w", cmdErr)
-	}
-	if readErr != nil {
-		return fmt.Errorf("failed to read pg_dumpall output: %w", readErr)
+		return fmt.Errorf("pg_dumpall failed: %w", err)
 	}
 
 	return os.WriteFile(globalsFile, output, 0644)
 }
 
-// createArchive creates a compressed tar archive using parallel gzip compression
-// Uses in-process pgzip for 2-4x faster compression on multi-core systems
+// createArchive creates a compressed tar archive
 func (e *Engine) createArchive(ctx context.Context, sourceDir, outputFile string) error {
-	e.log.Debug("Creating archive with parallel compression",
-		"source", sourceDir,
-		"output", outputFile,
-		"compression", e.cfg.CompressionLevel)
+	// Use pigz for faster parallel compression if available, otherwise use standard gzip
+	compressCmd := "tar"
+	compressArgs := []string{"-czf", outputFile, "-C", sourceDir, "."}
 
-	// Use in-process parallel compression with pgzip
-	err := fs.CreateTarGzParallel(ctx, sourceDir, outputFile, e.cfg.CompressionLevel, func(progress fs.CreateProgress) {
-		// Optional: log progress for large archives
-		if progress.FilesCount%100 == 0 && progress.FilesCount > 0 {
-			e.log.Debug("Archive progress", "files", progress.FilesCount, "bytes", progress.BytesWritten)
+	// Check if pigz is available for faster parallel compression
+	if _, err := exec.LookPath("pigz"); err == nil {
+		// Use pigz with number of cores for parallel compression
+		compressArgs = []string{"-cf", "-", "-C", sourceDir, "."}
+		cmd := exec.CommandContext(ctx, "tar", compressArgs...)
+
+		// Create output file
+		outFile, err := os.Create(outputFile)
+		if err != nil {
+			// Fallback to regular tar
+			goto regularTar
 		}
-	})
+		defer outFile.Close()
 
-	if err != nil {
-		return fmt.Errorf("parallel archive creation failed: %w", err)
+		// Pipe to pigz for parallel compression
+		pigzCmd := exec.CommandContext(ctx, "pigz", "-p", strconv.Itoa(e.cfg.Jobs))
+
+		tarOut, err := cmd.StdoutPipe()
+		if err != nil {
+			outFile.Close()
+			// Fallback to regular tar
+			goto regularTar
+		}
+		pigzCmd.Stdin = tarOut
+		pigzCmd.Stdout = outFile
+
+		// Start both commands
+		if err := pigzCmd.Start(); err != nil {
+			outFile.Close()
+			goto regularTar
+		}
+		if err := cmd.Start(); err != nil {
+			pigzCmd.Process.Kill()
+			outFile.Close()
+			goto regularTar
+		}
+
+		// Wait for tar with proper context handling
+		tarDone := make(chan error, 1)
+		go func() {
+			tarDone <- cmd.Wait()
+		}()
+
+		var tarErr error
+		select {
+		case tarErr = <-tarDone:
+			// tar completed
+		case <-ctx.Done():
+			e.log.Warn("Archive creation cancelled - killing processes")
+			cmd.Process.Kill()
+			pigzCmd.Process.Kill()
+			<-tarDone
+			return ctx.Err()
+		}
+
+		if tarErr != nil {
+			pigzCmd.Process.Kill()
+			return fmt.Errorf("tar failed: %w", tarErr)
+		}
+
+		// Wait for pigz with proper context handling
+		pigzDone := make(chan error, 1)
+		go func() {
+			pigzDone <- pigzCmd.Wait()
+		}()
+
+		var pigzErr error
+		select {
+		case pigzErr = <-pigzDone:
+		case <-ctx.Done():
+			pigzCmd.Process.Kill()
+			<-pigzDone
+			return ctx.Err()
+		}
+
+		if pigzErr != nil {
+			return fmt.Errorf("pigz compression failed: %w", pigzErr)
+		}
+		return nil
 	}
 
+regularTar:
+	// Standard tar with gzip (fallback)
+	cmd := exec.CommandContext(ctx, compressCmd, compressArgs...)
+
+	// Stream stderr to avoid memory issues
+	// Use io.Copy to ensure goroutine completes when pipe closes
+	stderr, err := cmd.StderrPipe()
+	if err == nil {
+		go func() {
+			scanner := bufio.NewScanner(stderr)
+			for scanner.Scan() {
+				line := scanner.Text()
+				if line != "" {
+					e.log.Debug("Archive creation", "output", line)
+				}
+			}
+			// Scanner will exit when stderr pipe closes after cmd.Wait()
+		}()
+	}
+
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("tar failed: %w", err)
+	}
+	// cmd.Run() calls Wait() which closes stderr pipe, terminating the goroutine
 	return nil
 }
 
@@ -1240,29 +1242,23 @@ func (e *Engine) uploadToCloud(ctx context.Context, backupFile string, tracker *
 	filename := filepath.Base(backupFile)
 	e.log.Info("Uploading backup to cloud", "file", filename, "size", cloud.FormatSize(info.Size()))
 
-	// Create schollz progressbar for visual upload progress
-	bar := progress.NewSchollzBar(info.Size(), fmt.Sprintf("Uploading %s", filename))
-
-	// Progress callback with schollz progressbar
-	var lastBytes int64
+	// Progress callback
+	var lastPercent int
 	progressCallback := func(transferred, total int64) {
-		delta := transferred - lastBytes
-		if delta > 0 {
-			_ = bar.Add64(delta)
+		percent := int(float64(transferred) / float64(total) * 100)
+		if percent != lastPercent && percent%10 == 0 {
+			e.log.Debug("Upload progress", "percent", percent, "transferred", cloud.FormatSize(transferred), "total", cloud.FormatSize(total))
+			lastPercent = percent
 		}
-		lastBytes = transferred
 	}
 
 	// Upload to cloud
 	err = backend.Upload(ctx, backupFile, filename, progressCallback)
 	if err != nil {
-		bar.Fail("Upload failed")
 		uploadStep.Fail(fmt.Errorf("cloud upload failed: %w", err))
 		return err
 	}
 
-	_ = bar.Finish()
-
 	// Also upload metadata file
 	metaFile := backupFile + ".meta.json"
 	if _, err := os.Stat(metaFile); err == nil {
@@ -1332,27 +1328,6 @@ func (e *Engine) executeCommand(ctx context.Context, cmdArgs []string, outputFil
 	// NO GO BUFFERING - pg_dump writes directly to disk
 	cmd := exec.CommandContext(ctx, cmdArgs[0], cmdArgs[1:]...)
 
-	// Start heartbeat ticker for backup progress
-	backupStart := time.Now()
-	heartbeatCtx, cancelHeartbeat := context.WithCancel(ctx)
-	heartbeatTicker := time.NewTicker(5 * time.Second)
-	defer heartbeatTicker.Stop()
-	defer cancelHeartbeat()
-
-	go func() {
-		for {
-			select {
-			case <-heartbeatTicker.C:
-				elapsed := time.Since(backupStart)
-				if e.progress != nil {
-					e.progress.Update(fmt.Sprintf("Backing up database... (elapsed: %s)", formatDuration(elapsed)))
-				}
-			case <-heartbeatCtx.Done():
-				return
-			}
-		}
-	}()
-
 	// Set environment variables for database tools
 	cmd.Env = os.Environ()
 	if e.cfg.Password != "" {
@@ -1417,10 +1392,10 @@ func (e *Engine) executeCommand(ctx context.Context, cmdArgs []string, outputFil
 	return nil
 }
 
-// executeWithStreamingCompression handles plain format dumps with in-process pgzip compression
-// Uses: pg_dump stdout → pgzip.Writer → file.sql.gz (no external process)
+// executeWithStreamingCompression handles plain format dumps with external compression
+// Uses: pg_dump | pigz > file.sql.gz (zero-copy streaming)
 func (e *Engine) executeWithStreamingCompression(ctx context.Context, cmdArgs []string, outputFile string) error {
-	e.log.Debug("Using in-process pgzip compression for large database")
+	e.log.Debug("Using streaming compression for large database")
 
 	// Derive compressed output filename. If the output was named *.dump we replace that
 	// with *.sql.gz; otherwise append .gz to the provided output file so we don't
@@ -1442,17 +1417,44 @@ func (e *Engine) executeWithStreamingCompression(ctx context.Context, cmdArgs []
 		dumpCmd.Env = append(dumpCmd.Env, "PGPASSWORD="+e.cfg.Password)
 	}
 
-	// Get stdout pipe from pg_dump
+	// Check for pigz (parallel gzip)
+	compressor := "gzip"
+	compressorArgs := []string{"-c"}
+
+	if _, err := exec.LookPath("pigz"); err == nil {
+		compressor = "pigz"
+		compressorArgs = []string{"-p", strconv.Itoa(e.cfg.Jobs), "-c"}
+		e.log.Debug("Using pigz for parallel compression", "threads", e.cfg.Jobs)
+	}
+
+	// Create compression command
+	compressCmd := exec.CommandContext(ctx, compressor, compressorArgs...)
+
+	// Create output file
+	outFile, err := os.Create(compressedFile)
+	if err != nil {
+		return fmt.Errorf("failed to create output file: %w", err)
+	}
+	defer outFile.Close()
+
+	// Set up pipeline: pg_dump | pigz > file.sql.gz
 	dumpStdout, err := dumpCmd.StdoutPipe()
 	if err != nil {
 		return fmt.Errorf("failed to create dump stdout pipe: %w", err)
 	}
 
-	// Capture stderr from pg_dump
+	compressCmd.Stdin = dumpStdout
+	compressCmd.Stdout = outFile
+
+	// Capture stderr from both commands
 	dumpStderr, err := dumpCmd.StderrPipe()
 	if err != nil {
 		e.log.Warn("Failed to capture dump stderr", "error", err)
 	}
+	compressStderr, err := compressCmd.StderrPipe()
+	if err != nil {
+		e.log.Warn("Failed to capture compress stderr", "error", err)
+	}
 
 	// Stream stderr output
 	if dumpStderr != nil {
@@ -1467,41 +1469,31 @@ func (e *Engine) executeWithStreamingCompression(ctx context.Context, cmdArgs []
 		}()
 	}
 
-	// Create output file
-	outFile, err := os.Create(compressedFile)
-	if err != nil {
-		return fmt.Errorf("failed to create output file: %w", err)
+	if compressStderr != nil {
+		go func() {
+			scanner := bufio.NewScanner(compressStderr)
+			for scanner.Scan() {
+				line := scanner.Text()
+				if line != "" {
+					e.log.Debug("compression", "output", line)
+				}
+			}
+		}()
 	}
-	defer outFile.Close()
 
-	// Create pgzip writer with parallel compression
-	// Use configured Jobs or default to NumCPU
-	workers := e.cfg.Jobs
-	if workers <= 0 {
-		workers = runtime.NumCPU()
+	// Start compression first
+	if err := compressCmd.Start(); err != nil {
+		return fmt.Errorf("failed to start compressor: %w", err)
 	}
-	gzWriter, err := pgzip.NewWriterLevel(outFile, pgzip.BestSpeed)
-	if err != nil {
-		return fmt.Errorf("failed to create pgzip writer: %w", err)
-	}
-	if err := gzWriter.SetConcurrency(256*1024, workers); err != nil {
-		e.log.Warn("Failed to set pgzip concurrency", "error", err)
-	}
-	e.log.Debug("Using pgzip for parallel compression", "workers", workers)
 
-	// Start pg_dump
+	// Then start pg_dump
 	if err := dumpCmd.Start(); err != nil {
+		compressCmd.Process.Kill()
 		return fmt.Errorf("failed to start pg_dump: %w", err)
 	}
 
-	// Copy from pg_dump stdout to pgzip writer in a goroutine
-	copyDone := make(chan error, 1)
-	go func() {
-		_, copyErr := io.Copy(gzWriter, dumpStdout)
-		copyDone <- copyErr
-	}()
-
 	// Wait for pg_dump in a goroutine to handle context timeout properly
+	// This prevents deadlock if pipe buffer fills and pg_dump blocks
 	dumpDone := make(chan error, 1)
 	go func() {
 		dumpDone <- dumpCmd.Wait()
@@ -1519,29 +1511,33 @@ func (e *Engine) executeWithStreamingCompression(ctx context.Context, cmdArgs []
 		dumpErr = ctx.Err()
 	}
 
-	// Wait for copy to complete
-	copyErr := <-copyDone
+	// Close stdout pipe to signal compressor we're done
+	// This MUST happen after pg_dump exits to avoid broken pipe
+	dumpStdout.Close()
 
-	// Close gzip writer to flush remaining data
-	gzCloseErr := gzWriter.Close()
+	// Wait for compression to complete
+	compressErr := compressCmd.Wait()
 
-	// Check errors in order of priority
+	// Check errors - compressor failure first (it's usually the root cause)
+	if compressErr != nil {
+		e.log.Error("Compressor failed", "error", compressErr)
+		return fmt.Errorf("compression failed (check disk space): %w", compressErr)
+	}
 	if dumpErr != nil {
+		// Check for SIGPIPE (exit code 141) - indicates compressor died first
+		if exitErr, ok := dumpErr.(*exec.ExitError); ok && exitErr.ExitCode() == 141 {
+			e.log.Error("pg_dump received SIGPIPE - compressor may have failed")
+			return fmt.Errorf("pg_dump broken pipe - check disk space and compressor")
+		}
 		return fmt.Errorf("pg_dump failed: %w", dumpErr)
 	}
-	if copyErr != nil {
-		return fmt.Errorf("compression copy failed: %w", copyErr)
-	}
-	if gzCloseErr != nil {
-		return fmt.Errorf("compression flush failed: %w", gzCloseErr)
-	}
 
 	// Sync file to disk to ensure durability (prevents truncation on power loss)
 	if err := outFile.Sync(); err != nil {
 		e.log.Warn("Failed to sync output file", "error", err)
 	}
 
-	e.log.Debug("In-process pgzip compression completed", "output", compressedFile)
+	e.log.Debug("Streaming compression completed", "output", compressedFile)
 	return nil
 }
 
@@ -1558,22 +1554,3 @@ func formatBytes(bytes int64) string {
 	}
 	return fmt.Sprintf("%.1f %cB", float64(bytes)/float64(div), "KMGTPE"[exp])
 }
-
-// formatDuration formats a duration to human readable format (e.g., "3m 45s", "1h 23m", "45s")
-func formatDuration(d time.Duration) string {
-	if d < time.Second {
-		return "0s"
-	}
-
-	hours := int(d.Hours())
-	minutes := int(d.Minutes()) % 60
-	seconds := int(d.Seconds()) % 60
-
-	if hours > 0 {
-		return fmt.Sprintf("%dh %dm", hours, minutes)
-	}
-	if minutes > 0 {
-		return fmt.Sprintf("%dm %ds", minutes, seconds)
-	}
-	return fmt.Sprintf("%ds", seconds)
-}

internal/backup/incremental_extract.go

@@ -2,13 +2,12 @@ package backup
 
 import (
 	"archive/tar"
+	"compress/gzip"
 	"context"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
-
-	"github.com/klauspost/pgzip"
 )
 
 // extractTarGz extracts a tar.gz archive to the specified directory
@@ -21,8 +20,8 @@ func (e *PostgresIncrementalEngine) extractTarGz(ctx context.Context, archivePat
 	}
 	defer archiveFile.Close()
 
-	// Create parallel gzip reader for faster decompression
-	gzReader, err := pgzip.NewReader(archiveFile)
+	// Create gzip reader
+	gzReader, err := gzip.NewReader(archiveFile)
 	if err != nil {
 		return fmt.Errorf("failed to create gzip reader: %w", err)
 	}

internal/backup/incremental_mysql.go

@@ -2,6 +2,7 @@ package backup
 
 import (
 	"archive/tar"
+	"compress/gzip"
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
@@ -12,8 +13,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/klauspost/pgzip"
-
 	"dbbackup/internal/logger"
 	"dbbackup/internal/metadata"
 )
@@ -368,15 +367,15 @@ func (e *MySQLIncrementalEngine) CalculateFileChecksum(path string) (string, err
 
 // createTarGz creates a tar.gz archive with the specified changed files
 func (e *MySQLIncrementalEngine) createTarGz(ctx context.Context, outputFile string, changedFiles []ChangedFile, config *IncrementalBackupConfig) error {
-	// Create output file
+	// Import needed for tar/gzip
 	outFile, err := os.Create(outputFile)
 	if err != nil {
 		return fmt.Errorf("failed to create output file: %w", err)
 	}
 	defer outFile.Close()
 
-	// Create parallel gzip writer for faster compression
-	gzWriter, err := pgzip.NewWriterLevel(outFile, config.CompressionLevel)
+	// Create gzip writer
+	gzWriter, err := gzip.NewWriterLevel(outFile, config.CompressionLevel)
 	if err != nil {
 		return fmt.Errorf("failed to create gzip writer: %w", err)
 	}
@@ -461,8 +460,8 @@ func (e *MySQLIncrementalEngine) extractTarGz(ctx context.Context, archivePath,
 	}
 	defer archiveFile.Close()
 
-	// Create parallel gzip reader for faster decompression
-	gzReader, err := pgzip.NewReader(archiveFile)
+	// Create gzip reader
+	gzReader, err := gzip.NewReader(archiveFile)
 	if err != nil {
 		return fmt.Errorf("failed to create gzip reader: %w", err)
 	}

internal/backup/incremental_tar.go

@@ -2,12 +2,11 @@ package backup
 
 import (
 	"archive/tar"
+	"compress/gzip"
 	"context"
 	"fmt"
 	"io"
 	"os"
-
-	"github.com/klauspost/pgzip"
 )
 
 // createTarGz creates a tar.gz archive with the specified changed files
@@ -19,8 +18,8 @@ func (e *PostgresIncrementalEngine) createTarGz(ctx context.Context, outputFile
 	}
 	defer outFile.Close()
 
-	// Create parallel gzip writer for faster compression
-	gzWriter, err := pgzip.NewWriterLevel(outFile, config.CompressionLevel)
+	// Create gzip writer
+	gzWriter, err := gzip.NewWriterLevel(outFile, config.CompressionLevel)
 	if err != nil {
 		return fmt.Errorf("failed to create gzip writer: %w", err)
 	}

internal/catalog/catalog.go

@@ -150,14 +150,12 @@ type Catalog interface {
 
 // SyncResult contains results from a catalog sync operation
 type SyncResult struct {
-	Added         int      `json:"added"`
-	Updated       int      `json:"updated"`
-	Removed       int      `json:"removed"`
-	Skipped       int      `json:"skipped"` // Files without metadata (legacy backups)
-	Errors        int      `json:"errors"`
-	Duration      float64  `json:"duration_seconds"`
-	Details       []string `json:"details,omitempty"`
-	LegacyWarning string   `json:"legacy_warning,omitempty"` // Warning about legacy files
+	Added    int      `json:"added"`
+	Updated  int      `json:"updated"`
+	Removed  int      `json:"removed"`
+	Errors   int      `json:"errors"`
+	Duration float64  `json:"duration_seconds"`
+	Details  []string `json:"details,omitempty"`
 }
 
 // FormatSize formats bytes as human-readable string

internal/catalog/sqlite.go

@@ -11,7 +11,7 @@ import (
 	"strings"
 	"time"
 
-	_ "modernc.org/sqlite" // Pure Go SQLite driver (no CGO required)
+	_ "github.com/mattn/go-sqlite3"
 )
 
 // SQLiteCatalog implements Catalog interface with SQLite storage
@@ -28,7 +28,7 @@ func NewSQLiteCatalog(dbPath string) (*SQLiteCatalog, error) {
 		return nil, fmt.Errorf("failed to create catalog directory: %w", err)
 	}
 
-	db, err := sql.Open("sqlite", dbPath+"?_journal_mode=WAL&_foreign_keys=ON")
+	db, err := sql.Open("sqlite3", dbPath+"?_journal_mode=WAL&_foreign_keys=ON")
 	if err != nil {
 		return nil, fmt.Errorf("failed to open catalog database: %w", err)
 	}
@@ -464,8 +464,8 @@ func (c *SQLiteCatalog) Stats(ctx context.Context) (*Stats, error) {
 			MAX(created_at),
 			COALESCE(AVG(duration), 0),
 			CAST(COALESCE(AVG(size_bytes), 0) AS INTEGER),
-			COALESCE(SUM(CASE WHEN verified_at IS NOT NULL THEN 1 ELSE 0 END), 0),
-			COALESCE(SUM(CASE WHEN drill_tested_at IS NOT NULL THEN 1 ELSE 0 END), 0)
+			SUM(CASE WHEN verified_at IS NOT NULL THEN 1 ELSE 0 END),
+			SUM(CASE WHEN drill_tested_at IS NOT NULL THEN 1 ELSE 0 END)
 		FROM backups WHERE status != 'deleted'
 	`)
 
@@ -548,8 +548,8 @@ func (c *SQLiteCatalog) StatsByDatabase(ctx context.Context, database string) (*
 			MAX(created_at),
 			COALESCE(AVG(duration), 0),
 			COALESCE(AVG(size_bytes), 0),
-			COALESCE(SUM(CASE WHEN verified_at IS NOT NULL THEN 1 ELSE 0 END), 0),
-			COALESCE(SUM(CASE WHEN drill_tested_at IS NOT NULL THEN 1 ELSE 0 END), 0)
+			SUM(CASE WHEN verified_at IS NOT NULL THEN 1 ELSE 0 END),
+			SUM(CASE WHEN drill_tested_at IS NOT NULL THEN 1 ELSE 0 END)
 		FROM backups WHERE database = ? AND status != 'deleted'
 	`, database)
 

internal/catalog/sync.go

@@ -30,33 +30,6 @@ func (c *SQLiteCatalog) SyncFromDirectory(ctx context.Context, dir string) (*Syn
 	subMatches, _ := filepath.Glob(subPattern)
 	matches = append(matches, subMatches...)
 
-	// Count legacy backups (files without metadata)
-	legacySkipped := 0
-	legacyPatterns := []string{
-		filepath.Join(dir, "*.sql"),
-		filepath.Join(dir, "*.sql.gz"),
-		filepath.Join(dir, "*.sql.lz4"),
-		filepath.Join(dir, "*.sql.zst"),
-		filepath.Join(dir, "*.dump"),
-		filepath.Join(dir, "*.dump.gz"),
-		filepath.Join(dir, "*", "*.sql"),
-		filepath.Join(dir, "*", "*.sql.gz"),
-	}
-	metaSet := make(map[string]bool)
-	for _, m := range matches {
-		// Store the backup file path (without .meta.json)
-		metaSet[strings.TrimSuffix(m, ".meta.json")] = true
-	}
-	for _, pat := range legacyPatterns {
-		legacyMatches, _ := filepath.Glob(pat)
-		for _, lm := range legacyMatches {
-			// Skip if this file has metadata
-			if !metaSet[lm] {
-				legacySkipped++
-			}
-		}
-	}
-
 	for _, metaPath := range matches {
 		// Derive backup file path from metadata path
 		backupPath := strings.TrimSuffix(metaPath, ".meta.json")
@@ -124,17 +97,6 @@ func (c *SQLiteCatalog) SyncFromDirectory(ctx context.Context, dir string) (*Syn
 		}
 	}
 
-	// Set legacy backup warning if applicable
-	result.Skipped = legacySkipped
-	if legacySkipped > 0 {
-		result.LegacyWarning = fmt.Sprintf(
-			"%d backup file(s) found without .meta.json metadata. "+
-				"These are likely legacy backups created by raw mysqldump/pg_dump. "+
-				"Only backups created by 'dbbackup backup' (with metadata) can be imported. "+
-				"To track legacy backups, re-create them using 'dbbackup backup' command.",
-			legacySkipped)
-	}
-
 	result.Duration = time.Since(start).Seconds()
 	return result, nil
 }

internal/checks/error_hints.go

@@ -68,8 +68,8 @@ func ClassifyError(errorMsg string) *ErrorClassification {
 			Type:     "critical",
 			Category: "locks",
 			Message:  errorMsg,
-			Hint:     "Lock table exhausted. Total capacity = max_locks_per_transaction × (max_connections + max_prepared_transactions). If you reduced VM size or max_connections, you need higher max_locks_per_transaction to compensate.",
-			Action:   "Fix: ALTER SYSTEM SET max_locks_per_transaction = 4096; then RESTART PostgreSQL. For smaller VMs with fewer connections, you need higher max_locks_per_transaction values.",
+			Hint:     "Lock table exhausted - typically caused by large objects in parallel restore",
+			Action:   "Increase max_locks_per_transaction in postgresql.conf to 512 or higher",
 			Severity: 2,
 		}
 	case "permission_denied":
@@ -142,8 +142,8 @@ func ClassifyError(errorMsg string) *ErrorClassification {
 			Type:     "critical",
 			Category: "locks",
 			Message:  errorMsg,
-			Hint:     "Lock table exhausted. Total capacity = max_locks_per_transaction × (max_connections + max_prepared_transactions). If you reduced VM size or max_connections, you need higher max_locks_per_transaction to compensate.",
-			Action:   "Fix: ALTER SYSTEM SET max_locks_per_transaction = 4096; then RESTART PostgreSQL. For smaller VMs with fewer connections, you need higher max_locks_per_transaction values.",
+			Hint:     "Lock table exhausted - typically caused by large objects in parallel restore",
+			Action:   "Increase max_locks_per_transaction in postgresql.conf to 512 or higher",
 			Severity: 2,
 		}
 	}

internal/checks/locks.go

@@ -1,181 +0,0 @@
-package checks
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"os/exec"
-	"regexp"
-	"strconv"
-	"strings"
-	"time"
-)
-
-// lockRecommendation represents a normalized recommendation for locks
-type lockRecommendation int
-
-const (
-	recIncrease lockRecommendation = iota
-	recSingleThreadedOrIncrease
-	recSingleThreaded
-)
-
-// determineLockRecommendation contains the pure logic (easy to unit-test).
-func determineLockRecommendation(locks, conns, prepared int64) (status CheckStatus, rec lockRecommendation) {
-	// follow same thresholds as legacy script
-	switch {
-	case locks < 2048:
-		return StatusFailed, recIncrease
-	case locks < 8192:
-		return StatusWarning, recIncrease
-	case locks < 65536:
-		return StatusWarning, recSingleThreadedOrIncrease
-	default:
-		return StatusPassed, recSingleThreaded
-	}
-}
-
-var nonDigits = regexp.MustCompile(`[^0-9]+`)
-
-// parseNumeric strips non-digits and parses up to 10 characters (like the shell helper)
-func parseNumeric(s string) (int64, error) {
-	if s == "" {
-		return 0, fmt.Errorf("empty string")
-	}
-	s = nonDigits.ReplaceAllString(s, "")
-	if len(s) > 10 {
-		s = s[:10]
-	}
-	v, err := strconv.ParseInt(s, 10, 64)
-	if err != nil {
-		return 0, fmt.Errorf("parse error: %w", err)
-	}
-	return v, nil
-}
-
-// execPsql runs psql with the supplied arguments and returns stdout (trimmed).
-// It attempts to avoid leaking passwords in error messages.
-func execPsql(ctx context.Context, args []string, env []string, useSudo bool) (string, error) {
-	var cmd *exec.Cmd
-	if useSudo {
-		// sudo -u postgres psql --no-psqlrc -t -A -c "..."
-		all := append([]string{"-u", "postgres", "--"}, "psql")
-		all = append(all, args...)
-		cmd = exec.CommandContext(ctx, "sudo", all...)
-	} else {
-		cmd = exec.CommandContext(ctx, "psql", args...)
-	}
-	cmd.Env = append(os.Environ(), env...)
-	out, err := cmd.Output()
-	if err != nil {
-		// prefer a concise error
-		return "", fmt.Errorf("psql failed: %w", err)
-	}
-	return strings.TrimSpace(string(out)), nil
-}
-
-// checkPostgresLocks probes PostgreSQL (via psql) and returns a PreflightCheck.
-// It intentionally does not require a live internal/database.Database; it uses
-// the configured connection parameters or falls back to local sudo when possible.
-func (p *PreflightChecker) checkPostgresLocks(ctx context.Context) PreflightCheck {
-	check := PreflightCheck{Name: "PostgreSQL lock configuration"}
-
-	if !p.cfg.IsPostgreSQL() {
-		check.Status = StatusSkipped
-		check.Message = "Skipped (not a PostgreSQL configuration)"
-		return check
-	}
-
-	// Build common psql args
-	psqlArgs := []string{"--no-psqlrc", "-t", "-A", "-c"}
-	queryLocks := "SHOW max_locks_per_transaction;"
-	queryConns := "SHOW max_connections;"
-	queryPrepared := "SHOW max_prepared_transactions;"
-
-	// Build connection flags
-	if p.cfg.Host != "" {
-		psqlArgs = append(psqlArgs, "-h", p.cfg.Host)
-	}
-	psqlArgs = append(psqlArgs, "-p", fmt.Sprint(p.cfg.Port))
-	if p.cfg.User != "" {
-		psqlArgs = append(psqlArgs, "-U", p.cfg.User)
-	}
-	// Use database if provided (helps some setups)
-	if p.cfg.Database != "" {
-		psqlArgs = append(psqlArgs, "-d", p.cfg.Database)
-	}
-
-	// Env: prefer PGPASSWORD if configured
-	env := []string{}
-	if p.cfg.Password != "" {
-		env = append(env, "PGPASSWORD="+p.cfg.Password)
-	}
-
-	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
-	defer cancel()
-
-	// helper to run a single SHOW query and parse numeric result
-	runShow := func(q string) (int64, error) {
-		args := append(psqlArgs, q)
-		out, err := execPsql(ctx, args, env, false)
-		if err != nil {
-			// If local host and no explicit auth, try sudo -u postgres
-			if (p.cfg.Host == "" || p.cfg.Host == "localhost" || p.cfg.Host == "127.0.0.1") && p.cfg.Password == "" {
-				out, err = execPsql(ctx, append(psqlArgs, q), env, true)
-				if err != nil {
-					return 0, err
-				}
-			} else {
-				return 0, err
-			}
-		}
-		v, err := parseNumeric(out)
-		if err != nil {
-			return 0, fmt.Errorf("non-numeric response from psql: %q", out)
-		}
-		return v, nil
-	}
-
-	locks, err := runShow(queryLocks)
-	if err != nil {
-		check.Status = StatusFailed
-		check.Message = "Could not read max_locks_per_transaction"
-		check.Details = err.Error()
-		return check
-	}
-
-	conns, err := runShow(queryConns)
-	if err != nil {
-		check.Status = StatusFailed
-		check.Message = "Could not read max_connections"
-		check.Details = err.Error()
-		return check
-	}
-
-	prepared, _ := runShow(queryPrepared) // optional; treat errors as zero
-
-	// Compute capacity
-	capacity := locks * (conns + prepared)
-
-	status, rec := determineLockRecommendation(locks, conns, prepared)
-	check.Status = status
-	check.Message = fmt.Sprintf("locks=%d connections=%d prepared=%d capacity=%d", locks, conns, prepared, capacity)
-
-	// Human-friendly details + actionable remediation
-	detailLines := []string{fmt.Sprintf("max_locks_per_transaction: %d", locks), fmt.Sprintf("max_connections: %d", conns), fmt.Sprintf("max_prepared_transactions: %d", prepared), fmt.Sprintf("Total lock capacity: %d", capacity)}
-
-	switch rec {
-	case recIncrease:
-		detailLines = append(detailLines, "RECOMMENDATION: Increase to at least 65536 and run restore single-threaded")
-		detailLines = append(detailLines, " sudo -u postgres psql -c \"ALTER SYSTEM SET max_locks_per_transaction = 65536;\" && sudo systemctl restart postgresql")
-		check.Details = strings.Join(detailLines, "\n")
-	case recSingleThreadedOrIncrease:
-		detailLines = append(detailLines, "RECOMMENDATION: Use single-threaded restore (--jobs 1 --parallel-dbs 1) or increase locks to 65536 and still prefer single-threaded")
-		check.Details = strings.Join(detailLines, "\n")
-	case recSingleThreaded:
-		detailLines = append(detailLines, "RECOMMENDATION: Single-threaded restore is safest for very large DBs")
-		check.Details = strings.Join(detailLines, "\n")
-	}
-
-	return check
-}

internal/checks/locks_test.go

@@ -1,55 +0,0 @@
-package checks
-
-import (
-	"testing"
-)
-
-func TestDetermineLockRecommendation(t *testing.T) {
-	tests := []struct {
-		locks    int64
-		conns    int64
-		prepared int64
-		exStatus CheckStatus
-		exRec    lockRecommendation
-	}{
-		{locks: 1024, conns: 100, prepared: 0, exStatus: StatusFailed, exRec: recIncrease},
-		{locks: 4096, conns: 200, prepared: 0, exStatus: StatusWarning, exRec: recIncrease},
-		{locks: 16384, conns: 200, prepared: 0, exStatus: StatusWarning, exRec: recSingleThreadedOrIncrease},
-		{locks: 65536, conns: 200, prepared: 0, exStatus: StatusPassed, exRec: recSingleThreaded},
-	}
-
-	for _, tc := range tests {
-		st, rec := determineLockRecommendation(tc.locks, tc.conns, tc.prepared)
-		if st != tc.exStatus {
-			t.Fatalf("locks=%d: status = %v, want %v", tc.locks, st, tc.exStatus)
-		}
-		if rec != tc.exRec {
-			t.Fatalf("locks=%d: rec = %v, want %v", tc.locks, rec, tc.exRec)
-		}
-	}
-}
-
-func TestParseNumeric(t *testing.T) {
-	cases := map[string]int64{
-		"4096":           4096,
-		"  4096\n":       4096,
-		"4096 (default)": 4096,
-		"unknown":        0, // should error
-	}
-
-	for in, want := range cases {
-		v, err := parseNumeric(in)
-		if want == 0 {
-			if err == nil {
-				t.Fatalf("expected error parsing %q", in)
-			}
-			continue
-		}
-		if err != nil {
-			t.Fatalf("parseNumeric(%q) error: %v", in, err)
-		}
-		if v != want {
-			t.Fatalf("parseNumeric(%q) = %d, want %d", in, v, want)
-		}
-	}
-}

internal/checks/preflight.go

@@ -120,17 +120,6 @@ func (p *PreflightChecker) RunAllChecks(ctx context.Context, dbName string) (*Pr
 		result.FailureCount++
 	}
 
-	// Postgres lock configuration check (provides explicit restore guidance)
-	locksCheck := p.checkPostgresLocks(ctx)
-	result.Checks = append(result.Checks, locksCheck)
-	if locksCheck.Status == StatusFailed {
-		result.AllPassed = false
-		result.FailureCount++
-	} else if locksCheck.Status == StatusWarning {
-		result.HasWarnings = true
-		result.WarningCount++
-	}
-
 	// Extract database info if connection succeeded
 	if dbCheck.Status == StatusPassed && p.db != nil {
 		version, _ := p.db.GetVersion(ctx)

internal/cloud/azure.go

@@ -151,51 +151,37 @@ func (a *AzureBackend) Upload(ctx context.Context, localPath, remotePath string,
 	return a.uploadSimple(ctx, file, blobName, fileSize, progress)
 }
 
-// uploadSimple uploads a file using simple upload (single request) with retry
+// uploadSimple uploads a file using simple upload (single request)
 func (a *AzureBackend) uploadSimple(ctx context.Context, file *os.File, blobName string, fileSize int64, progress ProgressCallback) error {
-	return RetryOperationWithNotify(ctx, DefaultRetryConfig(), func() error {
-		// Reset file position for retry
-		if _, err := file.Seek(0, 0); err != nil {
-			return fmt.Errorf("failed to reset file position: %w", err)
-		}
+	blockBlobClient := a.client.ServiceClient().NewContainerClient(a.containerName).NewBlockBlobClient(blobName)
 
-		blockBlobClient := a.client.ServiceClient().NewContainerClient(a.containerName).NewBlockBlobClient(blobName)
+	// Wrap reader with progress tracking
+	reader := NewProgressReader(file, fileSize, progress)
 
-		// Wrap reader with progress tracking
-		var reader io.Reader = NewProgressReader(file, fileSize, progress)
+	// Calculate MD5 hash for integrity
+	hash := sha256.New()
+	teeReader := io.TeeReader(reader, hash)
 
-		// Apply bandwidth throttling if configured
-		if a.config.BandwidthLimit > 0 {
-			reader = NewThrottledReader(ctx, reader, a.config.BandwidthLimit)
-		}
-
-		// Calculate MD5 hash for integrity
-		hash := sha256.New()
-		teeReader := io.TeeReader(reader, hash)
-
-		_, err := blockBlobClient.UploadStream(ctx, teeReader, &blockblob.UploadStreamOptions{
-			BlockSize: 4 * 1024 * 1024, // 4MB blocks
-		})
-		if err != nil {
-			return fmt.Errorf("failed to upload blob: %w", err)
-		}
-
-		// Store checksum as metadata
-		checksum := hex.EncodeToString(hash.Sum(nil))
-		metadata := map[string]*string{
-			"sha256": &checksum,
-		}
-
-		_, err = blockBlobClient.SetMetadata(ctx, metadata, nil)
-		if err != nil {
-			// Non-fatal: upload succeeded but metadata failed
-			fmt.Fprintf(os.Stderr, "Warning: failed to set blob metadata: %v\n", err)
-		}
-
-		return nil
-	}, func(err error, duration time.Duration) {
-		fmt.Printf("[Azure] Upload retry in %v: %v\n", duration, err)
+	_, err := blockBlobClient.UploadStream(ctx, teeReader, &blockblob.UploadStreamOptions{
+		BlockSize: 4 * 1024 * 1024, // 4MB blocks
 	})
+	if err != nil {
+		return fmt.Errorf("failed to upload blob: %w", err)
+	}
+
+	// Store checksum as metadata
+	checksum := hex.EncodeToString(hash.Sum(nil))
+	metadata := map[string]*string{
+		"sha256": &checksum,
+	}
+
+	_, err = blockBlobClient.SetMetadata(ctx, metadata, nil)
+	if err != nil {
+		// Non-fatal: upload succeeded but metadata failed
+		fmt.Fprintf(os.Stderr, "Warning: failed to set blob metadata: %v\n", err)
+	}
+
+	return nil
 }
 
 // uploadBlocks uploads a file using block blob staging (for large files)
@@ -209,13 +195,6 @@ func (a *AzureBackend) uploadBlocks(ctx context.Context, file *os.File, blobName
 	hash := sha256.New()
 	var totalUploaded int64
 
-	// Calculate throttle delay per byte if bandwidth limited
-	var throttleDelay time.Duration
-	if a.config.BandwidthLimit > 0 {
-		// Calculate nanoseconds per byte
-		throttleDelay = time.Duration(float64(time.Second) / float64(a.config.BandwidthLimit) * float64(blockSize))
-	}
-
 	for i := int64(0); i < numBlocks; i++ {
 		blockID := base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("block-%08d", i)))
 		blockIDs = append(blockIDs, blockID)
@@ -237,15 +216,6 @@ func (a *AzureBackend) uploadBlocks(ctx context.Context, file *os.File, blobName
 		// Update hash
 		hash.Write(blockData)
 
-		// Apply throttling between blocks if configured
-		if a.config.BandwidthLimit > 0 && i > 0 {
-			select {
-			case <-ctx.Done():
-				return ctx.Err()
-			case <-time.After(throttleDelay):
-			}
-		}
-
 		// Upload block
 		reader := bytes.NewReader(blockData)
 		_, err = blockBlobClient.StageBlock(ctx, blockID, streaming.NopCloser(reader), nil)
@@ -281,7 +251,7 @@ func (a *AzureBackend) uploadBlocks(ctx context.Context, file *os.File, blobName
 	return nil
 }
 
-// Download downloads a file from Azure Blob Storage with retry
+// Download downloads a file from Azure Blob Storage
 func (a *AzureBackend) Download(ctx context.Context, remotePath, localPath string, progress ProgressCallback) error {
 	blobName := strings.TrimPrefix(remotePath, "/")
 	blockBlobClient := a.client.ServiceClient().NewContainerClient(a.containerName).NewBlockBlobClient(blobName)
@@ -294,34 +264,30 @@ func (a *AzureBackend) Download(ctx context.Context, remotePath, localPath strin
 
 	fileSize := *props.ContentLength
 
-	return RetryOperationWithNotify(ctx, DefaultRetryConfig(), func() error {
-		// Download blob
-		resp, err := blockBlobClient.DownloadStream(ctx, nil)
-		if err != nil {
-			return fmt.Errorf("failed to download blob: %w", err)
-		}
-		defer resp.Body.Close()
+	// Download blob
+	resp, err := blockBlobClient.DownloadStream(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("failed to download blob: %w", err)
+	}
+	defer resp.Body.Close()
 
-		// Create/truncate local file
-		file, err := os.Create(localPath)
-		if err != nil {
-			return fmt.Errorf("failed to create file: %w", err)
-		}
-		defer file.Close()
+	// Create local file
+	file, err := os.Create(localPath)
+	if err != nil {
+		return fmt.Errorf("failed to create file: %w", err)
+	}
+	defer file.Close()
 
-		// Wrap reader with progress tracking
-		reader := NewProgressReader(resp.Body, fileSize, progress)
+	// Wrap reader with progress tracking
+	reader := NewProgressReader(resp.Body, fileSize, progress)
 
-		// Copy with progress
-		_, err = io.Copy(file, reader)
-		if err != nil {
-			return fmt.Errorf("failed to write file: %w", err)
-		}
+	// Copy with progress
+	_, err = io.Copy(file, reader)
+	if err != nil {
+		return fmt.Errorf("failed to write file: %w", err)
+	}
 
-		return nil
-	}, func(err error, duration time.Duration) {
-		fmt.Printf("[Azure] Download retry in %v: %v\n", duration, err)
-	})
+	return nil
 }
 
 // Delete deletes a file from Azure Blob Storage

internal/cloud/gcs.go

@@ -89,7 +89,7 @@ func (g *GCSBackend) Name() string {
 	return "gcs"
 }
 
-// Upload uploads a file to Google Cloud Storage with retry
+// Upload uploads a file to Google Cloud Storage
 func (g *GCSBackend) Upload(ctx context.Context, localPath, remotePath string, progress ProgressCallback) error {
 	file, err := os.Open(localPath)
 	if err != nil {
@@ -106,59 +106,45 @@ func (g *GCSBackend) Upload(ctx context.Context, localPath, remotePath string, p
 	// Remove leading slash from remote path
 	objectName := strings.TrimPrefix(remotePath, "/")
 
-	return RetryOperationWithNotify(ctx, DefaultRetryConfig(), func() error {
-		// Reset file position for retry
-		if _, err := file.Seek(0, 0); err != nil {
-			return fmt.Errorf("failed to reset file position: %w", err)
-		}
+	bucket := g.client.Bucket(g.bucketName)
+	object := bucket.Object(objectName)
 
-		bucket := g.client.Bucket(g.bucketName)
-		object := bucket.Object(objectName)
+	// Create writer with automatic chunking for large files
+	writer := object.NewWriter(ctx)
+	writer.ChunkSize = 16 * 1024 * 1024 // 16MB chunks for streaming
 
-		// Create writer with automatic chunking for large files
-		writer := object.NewWriter(ctx)
-		writer.ChunkSize = 16 * 1024 * 1024 // 16MB chunks for streaming
+	// Wrap reader with progress tracking and hash calculation
+	hash := sha256.New()
+	reader := NewProgressReader(io.TeeReader(file, hash), fileSize, progress)
 
-		// Wrap reader with progress tracking and hash calculation
-		hash := sha256.New()
-		var reader io.Reader = NewProgressReader(io.TeeReader(file, hash), fileSize, progress)
+	// Upload with progress tracking
+	_, err = io.Copy(writer, reader)
+	if err != nil {
+		writer.Close()
+		return fmt.Errorf("failed to upload object: %w", err)
+	}
 
-		// Apply bandwidth throttling if configured
-		if g.config.BandwidthLimit > 0 {
-			reader = NewThrottledReader(ctx, reader, g.config.BandwidthLimit)
-		}
+	// Close writer (finalizes upload)
+	if err := writer.Close(); err != nil {
+		return fmt.Errorf("failed to finalize upload: %w", err)
+	}
 
-		// Upload with progress tracking
-		_, err = io.Copy(writer, reader)
-		if err != nil {
-			writer.Close()
-			return fmt.Errorf("failed to upload object: %w", err)
-		}
-
-		// Close writer (finalizes upload)
-		if err := writer.Close(); err != nil {
-			return fmt.Errorf("failed to finalize upload: %w", err)
-		}
-
-		// Store checksum as metadata
-		checksum := hex.EncodeToString(hash.Sum(nil))
-		_, err = object.Update(ctx, storage.ObjectAttrsToUpdate{
-			Metadata: map[string]string{
-				"sha256": checksum,
-			},
-		})
-		if err != nil {
-			// Non-fatal: upload succeeded but metadata failed
-			fmt.Fprintf(os.Stderr, "Warning: failed to set object metadata: %v\n", err)
-		}
-
-		return nil
-	}, func(err error, duration time.Duration) {
-		fmt.Printf("[GCS] Upload retry in %v: %v\n", duration, err)
+	// Store checksum as metadata
+	checksum := hex.EncodeToString(hash.Sum(nil))
+	_, err = object.Update(ctx, storage.ObjectAttrsToUpdate{
+		Metadata: map[string]string{
+			"sha256": checksum,
+		},
 	})
+	if err != nil {
+		// Non-fatal: upload succeeded but metadata failed
+		fmt.Fprintf(os.Stderr, "Warning: failed to set object metadata: %v\n", err)
+	}
+
+	return nil
 }
 
-// Download downloads a file from Google Cloud Storage with retry
+// Download downloads a file from Google Cloud Storage
 func (g *GCSBackend) Download(ctx context.Context, remotePath, localPath string, progress ProgressCallback) error {
 	objectName := strings.TrimPrefix(remotePath, "/")
 
@@ -173,34 +159,30 @@ func (g *GCSBackend) Download(ctx context.Context, remotePath, localPath string,
 
 	fileSize := attrs.Size
 
-	return RetryOperationWithNotify(ctx, DefaultRetryConfig(), func() error {
-		// Create reader
-		reader, err := object.NewReader(ctx)
-		if err != nil {
-			return fmt.Errorf("failed to download object: %w", err)
-		}
-		defer reader.Close()
+	// Create reader
+	reader, err := object.NewReader(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to download object: %w", err)
+	}
+	defer reader.Close()
 
-		// Create/truncate local file
-		file, err := os.Create(localPath)
-		if err != nil {
-			return fmt.Errorf("failed to create file: %w", err)
-		}
-		defer file.Close()
+	// Create local file
+	file, err := os.Create(localPath)
+	if err != nil {
+		return fmt.Errorf("failed to create file: %w", err)
+	}
+	defer file.Close()
 
-		// Wrap reader with progress tracking
-		progressReader := NewProgressReader(reader, fileSize, progress)
+	// Wrap reader with progress tracking
+	progressReader := NewProgressReader(reader, fileSize, progress)
 
-		// Copy with progress
-		_, err = io.Copy(file, progressReader)
-		if err != nil {
-			return fmt.Errorf("failed to write file: %w", err)
-		}
+	// Copy with progress
+	_, err = io.Copy(file, progressReader)
+	if err != nil {
+		return fmt.Errorf("failed to write file: %w", err)
+	}
 
-		return nil
-	}, func(err error, duration time.Duration) {
-		fmt.Printf("[GCS] Download retry in %v: %v\n", duration, err)
-	})
+	return nil
 }
 
 // Delete deletes a file from Google Cloud Storage

internal/cloud/interface.go

@@ -46,19 +46,18 @@ type ProgressCallback func(bytesTransferred, totalBytes int64)
 
 // Config contains common configuration for cloud backends
 type Config struct {
-	Provider       string // "s3", "minio", "azure", "gcs", "b2"
-	Bucket         string // Bucket or container name
-	Region         string // Region (for S3)
-	Endpoint       string // Custom endpoint (for MinIO, S3-compatible)
-	AccessKey      string // Access key or account ID
-	SecretKey      string // Secret key or access token
-	UseSSL         bool   // Use SSL/TLS (default: true)
-	PathStyle      bool   // Use path-style addressing (for MinIO)
-	Prefix         string // Prefix for all operations (e.g., "backups/")
-	Timeout        int    // Timeout in seconds (default: 300)
-	MaxRetries     int    // Maximum retry attempts (default: 3)
-	Concurrency    int    // Upload/download concurrency (default: 5)
-	BandwidthLimit int64  // Maximum upload/download bandwidth in bytes/sec (0 = unlimited)
+	Provider    string // "s3", "minio", "azure", "gcs", "b2"
+	Bucket      string // Bucket or container name
+	Region      string // Region (for S3)
+	Endpoint    string // Custom endpoint (for MinIO, S3-compatible)
+	AccessKey   string // Access key or account ID
+	SecretKey   string // Secret key or access token
+	UseSSL      bool   // Use SSL/TLS (default: true)
+	PathStyle   bool   // Use path-style addressing (for MinIO)
+	Prefix      string // Prefix for all operations (e.g., "backups/")
+	Timeout     int    // Timeout in seconds (default: 300)
+	MaxRetries  int    // Maximum retry attempts (default: 3)
+	Concurrency int    // Upload/download concurrency (default: 5)
 }
 
 // NewBackend creates a new cloud storage backend based on the provider

internal/cloud/retry.go

@@ -1,258 +0,0 @@
-package cloud
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"strings"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-)
-
-// RetryConfig configures retry behavior
-type RetryConfig struct {
-	MaxRetries      int           // Maximum number of retries (0 = unlimited)
-	InitialInterval time.Duration // Initial backoff interval
-	MaxInterval     time.Duration // Maximum backoff interval
-	MaxElapsedTime  time.Duration // Maximum total time for retries
-	Multiplier      float64       // Backoff multiplier
-}
-
-// DefaultRetryConfig returns sensible defaults for cloud operations
-func DefaultRetryConfig() *RetryConfig {
-	return &RetryConfig{
-		MaxRetries:      5,
-		InitialInterval: 500 * time.Millisecond,
-		MaxInterval:     30 * time.Second,
-		MaxElapsedTime:  5 * time.Minute,
-		Multiplier:      2.0,
-	}
-}
-
-// AggressiveRetryConfig returns config for critical operations that need more retries
-func AggressiveRetryConfig() *RetryConfig {
-	return &RetryConfig{
-		MaxRetries:      10,
-		InitialInterval: 1 * time.Second,
-		MaxInterval:     60 * time.Second,
-		MaxElapsedTime:  15 * time.Minute,
-		Multiplier:      1.5,
-	}
-}
-
-// QuickRetryConfig returns config for operations that should fail fast
-func QuickRetryConfig() *RetryConfig {
-	return &RetryConfig{
-		MaxRetries:      3,
-		InitialInterval: 100 * time.Millisecond,
-		MaxInterval:     5 * time.Second,
-		MaxElapsedTime:  30 * time.Second,
-		Multiplier:      2.0,
-	}
-}
-
-// RetryOperation executes an operation with exponential backoff retry
-func RetryOperation(ctx context.Context, cfg *RetryConfig, operation func() error) error {
-	if cfg == nil {
-		cfg = DefaultRetryConfig()
-	}
-
-	// Create exponential backoff
-	expBackoff := backoff.NewExponentialBackOff()
-	expBackoff.InitialInterval = cfg.InitialInterval
-	expBackoff.MaxInterval = cfg.MaxInterval
-	expBackoff.MaxElapsedTime = cfg.MaxElapsedTime
-	expBackoff.Multiplier = cfg.Multiplier
-	expBackoff.Reset()
-
-	// Wrap with max retries if specified
-	var b backoff.BackOff = expBackoff
-	if cfg.MaxRetries > 0 {
-		b = backoff.WithMaxRetries(expBackoff, uint64(cfg.MaxRetries))
-	}
-
-	// Add context support
-	b = backoff.WithContext(b, ctx)
-
-	// Track attempts for logging
-	attempt := 0
-
-	// Wrap operation to handle permanent vs retryable errors
-	wrappedOp := func() error {
-		attempt++
-		err := operation()
-		if err == nil {
-			return nil
-		}
-
-		// Check if error is permanent (should not retry)
-		if IsPermanentError(err) {
-			return backoff.Permanent(err)
-		}
-
-		return err
-	}
-
-	return backoff.Retry(wrappedOp, b)
-}
-
-// RetryOperationWithNotify executes an operation with retry and calls notify on each retry
-func RetryOperationWithNotify(ctx context.Context, cfg *RetryConfig, operation func() error, notify func(err error, duration time.Duration)) error {
-	if cfg == nil {
-		cfg = DefaultRetryConfig()
-	}
-
-	// Create exponential backoff
-	expBackoff := backoff.NewExponentialBackOff()
-	expBackoff.InitialInterval = cfg.InitialInterval
-	expBackoff.MaxInterval = cfg.MaxInterval
-	expBackoff.MaxElapsedTime = cfg.MaxElapsedTime
-	expBackoff.Multiplier = cfg.Multiplier
-	expBackoff.Reset()
-
-	// Wrap with max retries if specified
-	var b backoff.BackOff = expBackoff
-	if cfg.MaxRetries > 0 {
-		b = backoff.WithMaxRetries(expBackoff, uint64(cfg.MaxRetries))
-	}
-
-	// Add context support
-	b = backoff.WithContext(b, ctx)
-
-	// Wrap operation to handle permanent vs retryable errors
-	wrappedOp := func() error {
-		err := operation()
-		if err == nil {
-			return nil
-		}
-
-		// Check if error is permanent (should not retry)
-		if IsPermanentError(err) {
-			return backoff.Permanent(err)
-		}
-
-		return err
-	}
-
-	return backoff.RetryNotify(wrappedOp, b, notify)
-}
-
-// IsPermanentError returns true if the error should not be retried
-func IsPermanentError(err error) bool {
-	if err == nil {
-		return false
-	}
-
-	errStr := strings.ToLower(err.Error())
-
-	// Authentication/authorization errors - don't retry
-	permanentPatterns := []string{
-		"access denied",
-		"forbidden",
-		"unauthorized",
-		"invalid credentials",
-		"invalid access key",
-		"invalid secret",
-		"no such bucket",
-		"bucket not found",
-		"container not found",
-		"nosuchbucket",
-		"nosuchkey",
-		"invalid argument",
-		"malformed",
-		"invalid request",
-		"permission denied",
-		"access control",
-		"policy",
-	}
-
-	for _, pattern := range permanentPatterns {
-		if strings.Contains(errStr, pattern) {
-			return true
-		}
-	}
-
-	return false
-}
-
-// IsRetryableError returns true if the error is transient and should be retried
-func IsRetryableError(err error) bool {
-	if err == nil {
-		return false
-	}
-
-	// Network errors are typically retryable
-	// Note: netErr.Temporary() is deprecated since Go 1.18 - most "temporary" errors are timeouts
-	var netErr net.Error
-	if ok := isNetError(err, &netErr); ok {
-		return netErr.Timeout()
-	}
-
-	errStr := strings.ToLower(err.Error())
-
-	// Transient errors - should retry
-	retryablePatterns := []string{
-		"timeout",
-		"connection reset",
-		"connection refused",
-		"connection closed",
-		"eof",
-		"broken pipe",
-		"temporary failure",
-		"service unavailable",
-		"internal server error",
-		"bad gateway",
-		"gateway timeout",
-		"too many requests",
-		"rate limit",
-		"throttl",
-		"slowdown",
-		"try again",
-		"retry",
-	}
-
-	for _, pattern := range retryablePatterns {
-		if strings.Contains(errStr, pattern) {
-			return true
-		}
-	}
-
-	return false
-}
-
-// isNetError checks if err wraps a net.Error
-func isNetError(err error, target *net.Error) bool {
-	for err != nil {
-		if ne, ok := err.(net.Error); ok {
-			*target = ne
-			return true
-		}
-		// Try to unwrap
-		if unwrapper, ok := err.(interface{ Unwrap() error }); ok {
-			err = unwrapper.Unwrap()
-		} else {
-			break
-		}
-	}
-	return false
-}
-
-// WithRetry is a helper that wraps a function with default retry logic
-func WithRetry(ctx context.Context, operationName string, fn func() error) error {
-	notify := func(err error, duration time.Duration) {
-		// Log retry attempts (caller can provide their own logger if needed)
-		fmt.Printf("[RETRY] %s failed, retrying in %v: %v\n", operationName, duration, err)
-	}
-
-	return RetryOperationWithNotify(ctx, DefaultRetryConfig(), fn, notify)
-}
-
-// WithRetryConfig is a helper that wraps a function with custom retry config
-func WithRetryConfig(ctx context.Context, cfg *RetryConfig, operationName string, fn func() error) error {
-	notify := func(err error, duration time.Duration) {
-		fmt.Printf("[RETRY] %s failed, retrying in %v: %v\n", operationName, duration, err)
-	}
-
-	return RetryOperationWithNotify(ctx, cfg, fn, notify)
-}

internal/cloud/s3.go

@@ -7,7 +7,6 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-	"time"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/config"
@@ -124,99 +123,63 @@ func (s *S3Backend) Upload(ctx context.Context, localPath, remotePath string, pr
 	return s.uploadSimple(ctx, file, key, fileSize, progress)
 }
 
-// uploadSimple performs a simple single-part upload with retry
+// uploadSimple performs a simple single-part upload
 func (s *S3Backend) uploadSimple(ctx context.Context, file *os.File, key string, fileSize int64, progress ProgressCallback) error {
-	return RetryOperationWithNotify(ctx, DefaultRetryConfig(), func() error {
-		// Reset file position for retry
-		if _, err := file.Seek(0, 0); err != nil {
-			return fmt.Errorf("failed to reset file position: %w", err)
-		}
+	// Create progress reader
+	var reader io.Reader = file
+	if progress != nil {
+		reader = NewProgressReader(file, fileSize, progress)
+	}
 
-		// Create progress reader
-		var reader io.Reader = file
-		if progress != nil {
-			reader = NewProgressReader(file, fileSize, progress)
-		}
-
-		// Apply bandwidth throttling if configured
-		if s.config.BandwidthLimit > 0 {
-			reader = NewThrottledReader(ctx, reader, s.config.BandwidthLimit)
-		}
-
-		// Upload to S3
-		_, err := s.client.PutObject(ctx, &s3.PutObjectInput{
-			Bucket: aws.String(s.bucket),
-			Key:    aws.String(key),
-			Body:   reader,
-		})
-
-		if err != nil {
-			return fmt.Errorf("failed to upload to S3: %w", err)
-		}
-
-		return nil
-	}, func(err error, duration time.Duration) {
-		fmt.Printf("[S3] Upload retry in %v: %v\n", duration, err)
+	// Upload to S3
+	_, err := s.client.PutObject(ctx, &s3.PutObjectInput{
+		Bucket: aws.String(s.bucket),
+		Key:    aws.String(key),
+		Body:   reader,
 	})
+
+	if err != nil {
+		return fmt.Errorf("failed to upload to S3: %w", err)
+	}
+
+	return nil
 }
 
-// uploadMultipart performs a multipart upload for large files with retry
+// uploadMultipart performs a multipart upload for large files
 func (s *S3Backend) uploadMultipart(ctx context.Context, file *os.File, key string, fileSize int64, progress ProgressCallback) error {
-	return RetryOperationWithNotify(ctx, AggressiveRetryConfig(), func() error {
-		// Reset file position for retry
-		if _, err := file.Seek(0, 0); err != nil {
-			return fmt.Errorf("failed to reset file position: %w", err)
-		}
+	// Create uploader with custom options
+	uploader := manager.NewUploader(s.client, func(u *manager.Uploader) {
+		// Part size: 10MB
+		u.PartSize = 10 * 1024 * 1024
 
-		// Calculate concurrency based on bandwidth limit
-		// If limited, reduce concurrency to make throttling more effective
-		concurrency := 10
-		if s.config.BandwidthLimit > 0 {
-			// With bandwidth limiting, use fewer concurrent parts
-			concurrency = 3
-		}
+		// Upload up to 10 parts concurrently
+		u.Concurrency = 10
 
-		// Create uploader with custom options
-		uploader := manager.NewUploader(s.client, func(u *manager.Uploader) {
-			// Part size: 10MB
-			u.PartSize = 10 * 1024 * 1024
-
-			// Adjust concurrency
-			u.Concurrency = concurrency
-
-			// Leave parts on failure for debugging
-			u.LeavePartsOnError = false
-		})
-
-		// Wrap file with progress reader
-		var reader io.Reader = file
-		if progress != nil {
-			reader = NewProgressReader(file, fileSize, progress)
-		}
-
-		// Apply bandwidth throttling if configured
-		if s.config.BandwidthLimit > 0 {
-			reader = NewThrottledReader(ctx, reader, s.config.BandwidthLimit)
-		}
-
-		// Upload with multipart
-		_, err := uploader.Upload(ctx, &s3.PutObjectInput{
-			Bucket: aws.String(s.bucket),
-			Key:    aws.String(key),
-			Body:   reader,
-		})
-
-		if err != nil {
-			return fmt.Errorf("multipart upload failed: %w", err)
-		}
-
-		return nil
-	}, func(err error, duration time.Duration) {
-		fmt.Printf("[S3] Multipart upload retry in %v: %v\n", duration, err)
+		// Leave parts on failure for debugging
+		u.LeavePartsOnError = false
 	})
+
+	// Wrap file with progress reader
+	var reader io.Reader = file
+	if progress != nil {
+		reader = NewProgressReader(file, fileSize, progress)
+	}
+
+	// Upload with multipart
+	_, err := uploader.Upload(ctx, &s3.PutObjectInput{
+		Bucket: aws.String(s.bucket),
+		Key:    aws.String(key),
+		Body:   reader,
+	})
+
+	if err != nil {
+		return fmt.Errorf("multipart upload failed: %w", err)
+	}
+
+	return nil
 }
 
-// Download downloads a file from S3 with retry
+// Download downloads a file from S3
 func (s *S3Backend) Download(ctx context.Context, remotePath, localPath string, progress ProgressCallback) error {
 	// Build S3 key
 	key := s.buildKey(remotePath)
@@ -227,44 +190,39 @@ func (s *S3Backend) Download(ctx context.Context, remotePath, localPath string,
 		return fmt.Errorf("failed to get object size: %w", err)
 	}
 
-	// Create directory for local file
+	// Download from S3
+	result, err := s.client.GetObject(ctx, &s3.GetObjectInput{
+		Bucket: aws.String(s.bucket),
+		Key:    aws.String(key),
+	})
+	if err != nil {
+		return fmt.Errorf("failed to download from S3: %w", err)
+	}
+	defer result.Body.Close()
+
+	// Create local file
 	if err := os.MkdirAll(filepath.Dir(localPath), 0755); err != nil {
 		return fmt.Errorf("failed to create directory: %w", err)
 	}
 
-	return RetryOperationWithNotify(ctx, DefaultRetryConfig(), func() error {
-		// Download from S3
-		result, err := s.client.GetObject(ctx, &s3.GetObjectInput{
-			Bucket: aws.String(s.bucket),
-			Key:    aws.String(key),
-		})
-		if err != nil {
-			return fmt.Errorf("failed to download from S3: %w", err)
-		}
-		defer result.Body.Close()
+	outFile, err := os.Create(localPath)
+	if err != nil {
+		return fmt.Errorf("failed to create local file: %w", err)
+	}
+	defer outFile.Close()
 
-		// Create/truncate local file
-		outFile, err := os.Create(localPath)
-		if err != nil {
-			return fmt.Errorf("failed to create local file: %w", err)
-		}
-		defer outFile.Close()
+	// Copy with progress tracking
+	var reader io.Reader = result.Body
+	if progress != nil {
+		reader = NewProgressReader(result.Body, size, progress)
+	}
 
-		// Copy with progress tracking
-		var reader io.Reader = result.Body
-		if progress != nil {
-			reader = NewProgressReader(result.Body, size, progress)
-		}
+	_, err = io.Copy(outFile, reader)
+	if err != nil {
+		return fmt.Errorf("failed to write file: %w", err)
+	}
 
-		_, err = io.Copy(outFile, reader)
-		if err != nil {
-			return fmt.Errorf("failed to write file: %w", err)
-		}
-
-		return nil
-	}, func(err error, duration time.Duration) {
-		fmt.Printf("[S3] Download retry in %v: %v\n", duration, err)
-	})
+	return nil
 }
 
 // List lists all backup files in S3

internal/cloud/throttle.go

@@ -1,251 +0,0 @@
-// Package cloud provides throttled readers for bandwidth limiting during cloud uploads/downloads
-package cloud
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-	"sync"
-	"time"
-)
-
-// ThrottledReader wraps an io.Reader and limits the read rate to a maximum bytes per second.
-// This is useful for cloud uploads where you don't want to saturate the network.
-type ThrottledReader struct {
-	reader      io.Reader
-	bytesPerSec int64         // Maximum bytes per second (0 = unlimited)
-	bytesRead   int64         // Bytes read in current window
-	windowStart time.Time     // Start of current measurement window
-	windowSize  time.Duration // Size of the measurement window
-	mu          sync.Mutex    // Protects bytesRead and windowStart
-	ctx         context.Context
-}
-
-// NewThrottledReader creates a new bandwidth-limited reader.
-// bytesPerSec is the maximum transfer rate in bytes per second.
-// Set to 0 for unlimited bandwidth.
-func NewThrottledReader(ctx context.Context, reader io.Reader, bytesPerSec int64) *ThrottledReader {
-	return &ThrottledReader{
-		reader:      reader,
-		bytesPerSec: bytesPerSec,
-		windowStart: time.Now(),
-		windowSize:  100 * time.Millisecond, // Measure in 100ms windows for smooth throttling
-		ctx:         ctx,
-	}
-}
-
-// Read implements io.Reader with bandwidth throttling
-func (t *ThrottledReader) Read(p []byte) (int, error) {
-	// No throttling if unlimited
-	if t.bytesPerSec <= 0 {
-		return t.reader.Read(p)
-	}
-
-	t.mu.Lock()
-
-	// Calculate how many bytes we're allowed in this window
-	now := time.Now()
-	elapsed := now.Sub(t.windowStart)
-
-	// If we've passed the window, reset
-	if elapsed >= t.windowSize {
-		t.bytesRead = 0
-		t.windowStart = now
-		elapsed = 0
-	}
-
-	// Calculate bytes allowed per window
-	bytesPerWindow := int64(float64(t.bytesPerSec) * t.windowSize.Seconds())
-
-	// How many bytes can we still read in this window?
-	remaining := bytesPerWindow - t.bytesRead
-	if remaining <= 0 {
-		// We've exhausted our quota for this window - wait for next window
-		sleepDuration := t.windowSize - elapsed
-		t.mu.Unlock()
-
-		select {
-		case <-t.ctx.Done():
-			return 0, t.ctx.Err()
-		case <-time.After(sleepDuration):
-		}
-
-		// Retry after sleeping
-		return t.Read(p)
-	}
-
-	// Limit read size to remaining quota
-	maxRead := len(p)
-	if int64(maxRead) > remaining {
-		maxRead = int(remaining)
-	}
-	t.mu.Unlock()
-
-	// Perform the actual read
-	n, err := t.reader.Read(p[:maxRead])
-
-	// Track bytes read
-	t.mu.Lock()
-	t.bytesRead += int64(n)
-	t.mu.Unlock()
-
-	return n, err
-}
-
-// ThrottledWriter wraps an io.Writer and limits the write rate.
-type ThrottledWriter struct {
-	writer       io.Writer
-	bytesPerSec  int64
-	bytesWritten int64
-	windowStart  time.Time
-	windowSize   time.Duration
-	mu           sync.Mutex
-	ctx          context.Context
-}
-
-// NewThrottledWriter creates a new bandwidth-limited writer.
-func NewThrottledWriter(ctx context.Context, writer io.Writer, bytesPerSec int64) *ThrottledWriter {
-	return &ThrottledWriter{
-		writer:      writer,
-		bytesPerSec: bytesPerSec,
-		windowStart: time.Now(),
-		windowSize:  100 * time.Millisecond,
-		ctx:         ctx,
-	}
-}
-
-// Write implements io.Writer with bandwidth throttling
-func (t *ThrottledWriter) Write(p []byte) (int, error) {
-	if t.bytesPerSec <= 0 {
-		return t.writer.Write(p)
-	}
-
-	totalWritten := 0
-	for totalWritten < len(p) {
-		t.mu.Lock()
-
-		now := time.Now()
-		elapsed := now.Sub(t.windowStart)
-
-		if elapsed >= t.windowSize {
-			t.bytesWritten = 0
-			t.windowStart = now
-			elapsed = 0
-		}
-
-		bytesPerWindow := int64(float64(t.bytesPerSec) * t.windowSize.Seconds())
-		remaining := bytesPerWindow - t.bytesWritten
-
-		if remaining <= 0 {
-			sleepDuration := t.windowSize - elapsed
-			t.mu.Unlock()
-
-			select {
-			case <-t.ctx.Done():
-				return totalWritten, t.ctx.Err()
-			case <-time.After(sleepDuration):
-			}
-			continue
-		}
-
-		// Calculate how much to write
-		toWrite := len(p) - totalWritten
-		if int64(toWrite) > remaining {
-			toWrite = int(remaining)
-		}
-		t.mu.Unlock()
-
-		// Write chunk
-		n, err := t.writer.Write(p[totalWritten : totalWritten+toWrite])
-		totalWritten += n
-
-		t.mu.Lock()
-		t.bytesWritten += int64(n)
-		t.mu.Unlock()
-
-		if err != nil {
-			return totalWritten, err
-		}
-	}
-
-	return totalWritten, nil
-}
-
-// ParseBandwidth parses a human-readable bandwidth string into bytes per second.
-// Supports: "10MB/s", "10MiB/s", "100KB/s", "1GB/s", "10Mbps", "100Kbps"
-// Returns 0 for empty or "unlimited"
-func ParseBandwidth(s string) (int64, error) {
-	if s == "" || s == "0" || s == "unlimited" {
-		return 0, nil
-	}
-
-	// Normalize input
-	s = strings.TrimSpace(s)
-	s = strings.ToLower(s)
-	s = strings.TrimSuffix(s, "/s")
-	s = strings.TrimSuffix(s, "ps") // For mbps/kbps
-
-	// Parse unit
-	var multiplier int64 = 1
-	var value float64
-
-	switch {
-	case strings.HasSuffix(s, "gib"):
-		multiplier = 1024 * 1024 * 1024
-		s = strings.TrimSuffix(s, "gib")
-	case strings.HasSuffix(s, "gb"):
-		multiplier = 1000 * 1000 * 1000
-		s = strings.TrimSuffix(s, "gb")
-	case strings.HasSuffix(s, "mib"):
-		multiplier = 1024 * 1024
-		s = strings.TrimSuffix(s, "mib")
-	case strings.HasSuffix(s, "mb"):
-		multiplier = 1000 * 1000
-		s = strings.TrimSuffix(s, "mb")
-	case strings.HasSuffix(s, "kib"):
-		multiplier = 1024
-		s = strings.TrimSuffix(s, "kib")
-	case strings.HasSuffix(s, "kb"):
-		multiplier = 1000
-		s = strings.TrimSuffix(s, "kb")
-	case strings.HasSuffix(s, "b"):
-		multiplier = 1
-		s = strings.TrimSuffix(s, "b")
-	default:
-		// Assume MB if no unit
-		multiplier = 1000 * 1000
-	}
-
-	// Parse numeric value
-	_, err := fmt.Sscanf(s, "%f", &value)
-	if err != nil {
-		return 0, fmt.Errorf("invalid bandwidth value: %s", s)
-	}
-
-	return int64(value * float64(multiplier)), nil
-}
-
-// FormatBandwidth returns a human-readable bandwidth string
-func FormatBandwidth(bytesPerSec int64) string {
-	if bytesPerSec <= 0 {
-		return "unlimited"
-	}
-
-	const (
-		KB = 1000
-		MB = 1000 * KB
-		GB = 1000 * MB
-	)
-
-	switch {
-	case bytesPerSec >= GB:
-		return fmt.Sprintf("%.1f GB/s", float64(bytesPerSec)/float64(GB))
-	case bytesPerSec >= MB:
-		return fmt.Sprintf("%.1f MB/s", float64(bytesPerSec)/float64(MB))
-	case bytesPerSec >= KB:
-		return fmt.Sprintf("%.1f KB/s", float64(bytesPerSec)/float64(KB))
-	default:
-		return fmt.Sprintf("%d B/s", bytesPerSec)
-	}
-}

internal/cloud/throttle_test.go

@@ -1,175 +0,0 @@
-package cloud
-
-import (
-	"bytes"
-	"context"
-	"io"
-	"testing"
-	"time"
-)
-
-func TestParseBandwidth(t *testing.T) {
-	tests := []struct {
-		input    string
-		expected int64
-		wantErr  bool
-	}{
-		// Empty/unlimited
-		{"", 0, false},
-		{"0", 0, false},
-		{"unlimited", 0, false},
-
-		// Megabytes per second (SI)
-		{"10MB/s", 10 * 1000 * 1000, false},
-		{"10mb/s", 10 * 1000 * 1000, false},
-		{"10MB", 10 * 1000 * 1000, false},
-		{"100MB/s", 100 * 1000 * 1000, false},
-
-		// Mebibytes per second (binary)
-		{"10MiB/s", 10 * 1024 * 1024, false},
-		{"10mib/s", 10 * 1024 * 1024, false},
-
-		// Kilobytes
-		{"500KB/s", 500 * 1000, false},
-		{"500KiB/s", 500 * 1024, false},
-
-		// Gigabytes
-		{"1GB/s", 1000 * 1000 * 1000, false},
-		{"1GiB/s", 1024 * 1024 * 1024, false},
-
-		// Megabits per second
-		{"100Mbps", 100 * 1000 * 1000, false},
-
-		// Plain bytes
-		{"1000B/s", 1000, false},
-
-		// No unit (assumes MB)
-		{"50", 50 * 1000 * 1000, false},
-
-		// Decimal values
-		{"1.5MB/s", 1500000, false},
-		{"0.5GB/s", 500 * 1000 * 1000, false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.input, func(t *testing.T) {
-			got, err := ParseBandwidth(tt.input)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("ParseBandwidth(%q) error = %v, wantErr %v", tt.input, err, tt.wantErr)
-				return
-			}
-			if got != tt.expected {
-				t.Errorf("ParseBandwidth(%q) = %d, want %d", tt.input, got, tt.expected)
-			}
-		})
-	}
-}
-
-func TestFormatBandwidth(t *testing.T) {
-	tests := []struct {
-		input    int64
-		expected string
-	}{
-		{0, "unlimited"},
-		{500, "500 B/s"},
-		{1500, "1.5 KB/s"},
-		{10 * 1000 * 1000, "10.0 MB/s"},
-		{1000 * 1000 * 1000, "1.0 GB/s"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.expected, func(t *testing.T) {
-			got := FormatBandwidth(tt.input)
-			if got != tt.expected {
-				t.Errorf("FormatBandwidth(%d) = %q, want %q", tt.input, got, tt.expected)
-			}
-		})
-	}
-}
-
-func TestThrottledReader_Unlimited(t *testing.T) {
-	data := []byte("hello world")
-	reader := bytes.NewReader(data)
-	ctx := context.Background()
-
-	throttled := NewThrottledReader(ctx, reader, 0) // 0 = unlimited
-
-	result, err := io.ReadAll(throttled)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !bytes.Equal(result, data) {
-		t.Errorf("got %q, want %q", result, data)
-	}
-}
-
-func TestThrottledReader_Limited(t *testing.T) {
-	// Create 1KB of data
-	data := make([]byte, 1024)
-	for i := range data {
-		data[i] = byte(i % 256)
-	}
-
-	reader := bytes.NewReader(data)
-	ctx := context.Background()
-
-	// Limit to 512 bytes/second - should take ~2 seconds
-	throttled := NewThrottledReader(ctx, reader, 512)
-
-	start := time.Now()
-	result, err := io.ReadAll(throttled)
-	elapsed := time.Since(start)
-
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !bytes.Equal(result, data) {
-		t.Errorf("data mismatch: got %d bytes, want %d bytes", len(result), len(data))
-	}
-
-	// Should take at least 1.5 seconds (allowing some margin)
-	if elapsed < 1500*time.Millisecond {
-		t.Errorf("read completed too fast: %v (expected ~2s for 1KB at 512B/s)", elapsed)
-	}
-}
-
-func TestThrottledReader_CancelContext(t *testing.T) {
-	data := make([]byte, 10*1024) // 10KB
-	reader := bytes.NewReader(data)
-
-	ctx, cancel := context.WithCancel(context.Background())
-
-	// Very slow rate
-	throttled := NewThrottledReader(ctx, reader, 100)
-
-	// Cancel after 100ms
-	go func() {
-		time.Sleep(100 * time.Millisecond)
-		cancel()
-	}()
-
-	_, err := io.ReadAll(throttled)
-	if err != context.Canceled {
-		t.Errorf("expected context.Canceled, got %v", err)
-	}
-}
-
-func TestThrottledWriter_Unlimited(t *testing.T) {
-	ctx := context.Background()
-	var buf bytes.Buffer
-
-	throttled := NewThrottledWriter(ctx, &buf, 0) // 0 = unlimited
-
-	data := []byte("hello world")
-	n, err := throttled.Write(data)
-
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if n != len(data) {
-		t.Errorf("wrote %d bytes, want %d", n, len(data))
-	}
-	if !bytes.Equal(buf.Bytes(), data) {
-		t.Errorf("got %q, want %q", buf.Bytes(), data)
-	}
-}

internal/config/config.go

@@ -17,16 +17,12 @@ type Config struct {
 	BuildTime string
 	GitCommit string
 
-	// Config file path (--config flag)
-	ConfigPath string
-
 	// Database connection
 	Host         string
 	Port         int
 	User         string
 	Database     string
 	Password     string
-	Socket       string // Unix socket path for MySQL/MariaDB
 	DatabaseType string // "postgres" or "mysql"
 	SSLMode      string
 	Insecure     bool
@@ -40,27 +36,19 @@ type Config struct {
 	AutoDetectCores  bool
 	CPUWorkloadType  string // "cpu-intensive", "io-intensive", "balanced"
 
-	// Resource profile for backup/restore operations
-	ResourceProfile string // "conservative", "balanced", "performance", "max-performance", "turbo"
-	LargeDBMode     bool   // Enable large database mode (reduces parallelism, increases max_locks)
-	BufferedIO      bool   // Use 32KB buffered I/O for faster extraction (turbo profile)
-	ParallelExtract bool   // Enable parallel file extraction where possible (turbo profile)
-
 	// CPU detection
 	CPUDetector *cpu.Detector
 	CPUInfo     *cpu.CPUInfo
-	MemoryInfo  *cpu.MemoryInfo // System memory information
 
 	// Sample backup options
 	SampleStrategy string // "ratio", "percent", "count"
 	SampleValue    int
 
 	// Output options
-	NoColor    bool
-	Debug      bool
-	DebugLocks bool // Extended lock debugging (captures lock detection, Guard decisions, boost attempts)
-	LogLevel   string
-	LogFormat  string
+	NoColor   bool
+	Debug     bool
+	LogLevel  string
+	LogFormat string
 
 	// Config persistence
 	NoSaveConfig bool
@@ -190,13 +178,6 @@ func New() *Config {
 		sslMode = ""
 	}
 
-	// Detect memory information
-	memInfo, _ := cpu.DetectMemory()
-
-	// Determine recommended resource profile
-	recommendedProfile := cpu.RecommendProfile(cpuInfo, memInfo, false)
-	defaultProfile := getEnvString("RESOURCE_PROFILE", recommendedProfile.Name)
-
 	cfg := &Config{
 		// Database defaults
 		Host:         host,
@@ -208,21 +189,18 @@ func New() *Config {
 		SSLMode:      sslMode,
 		Insecure:     getEnvBool("INSECURE", false),
 
-		// Backup defaults - use recommended profile's settings for small VMs
+		// Backup defaults
 		BackupDir:        backupDir,
 		CompressionLevel: getEnvInt("COMPRESS_LEVEL", 6),
-		Jobs:             getEnvInt("JOBS", recommendedProfile.Jobs),
-		DumpJobs:         getEnvInt("DUMP_JOBS", recommendedProfile.DumpJobs),
+		Jobs:             getEnvInt("JOBS", getDefaultJobs(cpuInfo)),
+		DumpJobs:         getEnvInt("DUMP_JOBS", getDefaultDumpJobs(cpuInfo)),
 		MaxCores:         getEnvInt("MAX_CORES", getDefaultMaxCores(cpuInfo)),
 		AutoDetectCores:  getEnvBool("AUTO_DETECT_CORES", true),
 		CPUWorkloadType:  getEnvString("CPU_WORKLOAD_TYPE", "balanced"),
-		ResourceProfile:  defaultProfile,
-		LargeDBMode:      getEnvBool("LARGE_DB_MODE", false),
 
-		// CPU and memory detection
+		// CPU detection
 		CPUDetector: cpuDetector,
 		CPUInfo:     cpuInfo,
-		MemoryInfo:  memInfo,
 
 		// Sample backup defaults
 		SampleStrategy: getEnvString("SAMPLE_STRATEGY", "ratio"),
@@ -242,8 +220,8 @@ func New() *Config {
 		// Timeouts - default 24 hours (1440 min) to handle very large databases with large objects
 		ClusterTimeoutMinutes: getEnvInt("CLUSTER_TIMEOUT_MIN", 1440),
 
-		// Cluster parallelism - use recommended profile's setting for small VMs
-		ClusterParallelism: getEnvInt("CLUSTER_PARALLELISM", recommendedProfile.ClusterParallelism),
+		// Cluster parallelism (default: 2 concurrent operations for faster cluster backup/restore)
+		ClusterParallelism: getEnvInt("CLUSTER_PARALLELISM", 2),
 
 		// Working directory for large operations (default: system temp)
 		WorkDir: getEnvString("WORK_DIR", ""),
@@ -431,66 +409,6 @@ func (c *Config) OptimizeForCPU() error {
 	return nil
 }
 
-// ApplyResourceProfile applies a resource profile to the configuration
-// This adjusts parallelism settings based on the chosen profile
-func (c *Config) ApplyResourceProfile(profileName string) error {
-	profile := cpu.GetProfileByName(profileName)
-	if profile == nil {
-		return &ConfigError{
-			Field:   "resource_profile",
-			Value:   profileName,
-			Message: "unknown profile. Valid profiles: conservative, balanced, performance, max-performance, turbo",
-		}
-	}
-
-	// Validate profile against current system
-	isValid, warnings := cpu.ValidateProfileForSystem(profile, c.CPUInfo, c.MemoryInfo)
-	if !isValid {
-		// Log warnings but don't block - user may know what they're doing
-		_ = warnings // In production, log these warnings
-	}
-
-	// Apply profile settings
-	c.ResourceProfile = profile.Name
-
-	// If LargeDBMode is enabled, apply its modifiers
-	if c.LargeDBMode {
-		profile = cpu.ApplyLargeDBMode(profile)
-	}
-
-	c.ClusterParallelism = profile.ClusterParallelism
-	c.Jobs = profile.Jobs
-	c.DumpJobs = profile.DumpJobs
-
-	// Apply turbo mode optimizations
-	c.BufferedIO = profile.BufferedIO
-	c.ParallelExtract = profile.ParallelExtract
-
-	return nil
-}
-
-// GetResourceProfileRecommendation returns the recommended profile and reason
-func (c *Config) GetResourceProfileRecommendation(isLargeDB bool) (string, string) {
-	profile, reason := cpu.RecommendProfileWithReason(c.CPUInfo, c.MemoryInfo, isLargeDB)
-	return profile.Name, reason
-}
-
-// GetCurrentProfile returns the current resource profile details
-// If LargeDBMode is enabled, returns a modified profile with reduced parallelism
-func (c *Config) GetCurrentProfile() *cpu.ResourceProfile {
-	profile := cpu.GetProfileByName(c.ResourceProfile)
-	if profile == nil {
-		return nil
-	}
-
-	// Apply LargeDBMode modifier if enabled
-	if c.LargeDBMode {
-		return cpu.ApplyLargeDBMode(profile)
-	}
-
-	return profile
-}
-
 // GetCPUInfo returns CPU information, detecting if necessary
 func (c *Config) GetCPUInfo() (*cpu.CPUInfo, error) {
 	if c.CPUInfo != nil {
@@ -619,6 +537,37 @@ func getDefaultBackupDir() string {
 	return filepath.Join(os.TempDir(), "db_backups")
 }
 
+// CPU-related helper functions
+func getDefaultJobs(cpuInfo *cpu.CPUInfo) int {
+	if cpuInfo == nil {
+		return 1
+	}
+	// Default to logical cores for restore operations
+	jobs := cpuInfo.LogicalCores
+	if jobs < 1 {
+		jobs = 1
+	}
+	if jobs > 16 {
+		jobs = 16 // Safety limit
+	}
+	return jobs
+}
+
+func getDefaultDumpJobs(cpuInfo *cpu.CPUInfo) int {
+	if cpuInfo == nil {
+		return 1
+	}
+	// Use physical cores for dump operations (CPU intensive)
+	jobs := cpuInfo.PhysicalCores
+	if jobs < 1 {
+		jobs = 1
+	}
+	if jobs > 8 {
+		jobs = 8 // Conservative limit for dumps
+	}
+	return jobs
+}
+
 func getDefaultMaxCores(cpuInfo *cpu.CPUInfo) int {
 	if cpuInfo == nil {
 		return 16

internal/config/config_test.go

@@ -1,260 +0,0 @@
-package config
-
-import (
-	"os"
-	"testing"
-)
-
-func TestNew(t *testing.T) {
-	cfg := New()
-	if cfg == nil {
-		t.Fatal("expected non-nil config")
-	}
-
-	// Check defaults
-	if cfg.Host == "" {
-		t.Error("expected non-empty host")
-	}
-	if cfg.Port == 0 {
-		t.Error("expected non-zero port")
-	}
-	if cfg.User == "" {
-		t.Error("expected non-empty user")
-	}
-	if cfg.DatabaseType != "postgres" && cfg.DatabaseType != "mysql" {
-		t.Errorf("expected valid database type, got %q", cfg.DatabaseType)
-	}
-}
-
-func TestIsPostgreSQL(t *testing.T) {
-	tests := []struct {
-		dbType   string
-		expected bool
-	}{
-		{"postgres", true},
-		{"mysql", false},
-		{"mariadb", false},
-		{"", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.dbType, func(t *testing.T) {
-			cfg := &Config{DatabaseType: tt.dbType}
-			if got := cfg.IsPostgreSQL(); got != tt.expected {
-				t.Errorf("IsPostgreSQL() = %v, want %v", got, tt.expected)
-			}
-		})
-	}
-}
-
-func TestIsMySQL(t *testing.T) {
-	tests := []struct {
-		dbType   string
-		expected bool
-	}{
-		{"mysql", true},
-		{"mariadb", true},
-		{"postgres", false},
-		{"", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.dbType, func(t *testing.T) {
-			cfg := &Config{DatabaseType: tt.dbType}
-			if got := cfg.IsMySQL(); got != tt.expected {
-				t.Errorf("IsMySQL() = %v, want %v", got, tt.expected)
-			}
-		})
-	}
-}
-
-func TestSetDatabaseType(t *testing.T) {
-	tests := []struct {
-		input       string
-		expected    string
-		shouldError bool
-	}{
-		{"postgres", "postgres", false},
-		{"postgresql", "postgres", false},
-		{"POSTGRES", "postgres", false},
-		{"mysql", "mysql", false},
-		{"MYSQL", "mysql", false},
-		{"mariadb", "mariadb", false},
-		{"invalid", "", true},
-		{"", "", true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.input, func(t *testing.T) {
-			cfg := &Config{Port: 0}
-			err := cfg.SetDatabaseType(tt.input)
-
-			if tt.shouldError {
-				if err == nil {
-					t.Error("expected error, got nil")
-				}
-			} else {
-				if err != nil {
-					t.Errorf("unexpected error: %v", err)
-				}
-				if cfg.DatabaseType != tt.expected {
-					t.Errorf("DatabaseType = %q, want %q", cfg.DatabaseType, tt.expected)
-				}
-			}
-		})
-	}
-}
-
-func TestSetDatabaseTypePortDefaults(t *testing.T) {
-	cfg := &Config{Port: 0}
-	_ = cfg.SetDatabaseType("postgres")
-	if cfg.Port != 5432 {
-		t.Errorf("expected PostgreSQL default port 5432, got %d", cfg.Port)
-	}
-
-	cfg = &Config{Port: 0}
-	_ = cfg.SetDatabaseType("mysql")
-	if cfg.Port != 3306 {
-		t.Errorf("expected MySQL default port 3306, got %d", cfg.Port)
-	}
-}
-
-func TestGetEnvString(t *testing.T) {
-	os.Setenv("TEST_CONFIG_VAR", "test_value")
-	defer os.Unsetenv("TEST_CONFIG_VAR")
-
-	if got := getEnvString("TEST_CONFIG_VAR", "default"); got != "test_value" {
-		t.Errorf("getEnvString() = %q, want %q", got, "test_value")
-	}
-
-	if got := getEnvString("NONEXISTENT_VAR", "default"); got != "default" {
-		t.Errorf("getEnvString() = %q, want %q", got, "default")
-	}
-}
-
-func TestGetEnvInt(t *testing.T) {
-	os.Setenv("TEST_INT_VAR", "42")
-	defer os.Unsetenv("TEST_INT_VAR")
-
-	if got := getEnvInt("TEST_INT_VAR", 0); got != 42 {
-		t.Errorf("getEnvInt() = %d, want %d", got, 42)
-	}
-
-	os.Setenv("TEST_INT_VAR", "invalid")
-	if got := getEnvInt("TEST_INT_VAR", 10); got != 10 {
-		t.Errorf("getEnvInt() with invalid = %d, want %d", got, 10)
-	}
-
-	if got := getEnvInt("NONEXISTENT_INT_VAR", 99); got != 99 {
-		t.Errorf("getEnvInt() nonexistent = %d, want %d", got, 99)
-	}
-}
-
-func TestGetEnvBool(t *testing.T) {
-	tests := []struct {
-		envValue string
-		expected bool
-	}{
-		{"true", true},
-		{"TRUE", true},
-		{"1", true},
-		{"false", false},
-		{"FALSE", false},
-		{"0", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.envValue, func(t *testing.T) {
-			os.Setenv("TEST_BOOL_VAR", tt.envValue)
-			defer os.Unsetenv("TEST_BOOL_VAR")
-
-			if got := getEnvBool("TEST_BOOL_VAR", false); got != tt.expected {
-				t.Errorf("getEnvBool(%q) = %v, want %v", tt.envValue, got, tt.expected)
-			}
-		})
-	}
-}
-
-func TestCanonicalDatabaseType(t *testing.T) {
-	tests := []struct {
-		input    string
-		expected string
-		ok       bool
-	}{
-		{"postgres", "postgres", true},
-		{"postgresql", "postgres", true},
-		{"pg", "postgres", true},
-		{"POSTGRES", "postgres", true},
-		{"mysql", "mysql", true},
-		{"MYSQL", "mysql", true},
-		{"mariadb", "mariadb", true},
-		{"maria", "mariadb", true},
-		{"invalid", "", false},
-		{"", "", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.input, func(t *testing.T) {
-			got, ok := canonicalDatabaseType(tt.input)
-			if ok != tt.ok {
-				t.Errorf("canonicalDatabaseType(%q) ok = %v, want %v", tt.input, ok, tt.ok)
-			}
-			if got != tt.expected {
-				t.Errorf("canonicalDatabaseType(%q) = %q, want %q", tt.input, got, tt.expected)
-			}
-		})
-	}
-}
-
-func TestDisplayDatabaseType(t *testing.T) {
-	tests := []struct {
-		dbType   string
-		expected string
-	}{
-		{"postgres", "PostgreSQL"},
-		{"mysql", "MySQL"},
-		{"mariadb", "MariaDB"},
-		{"unknown", "unknown"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.dbType, func(t *testing.T) {
-			cfg := &Config{DatabaseType: tt.dbType}
-			if got := cfg.DisplayDatabaseType(); got != tt.expected {
-				t.Errorf("DisplayDatabaseType() = %q, want %q", got, tt.expected)
-			}
-		})
-	}
-}
-
-func TestConfigError(t *testing.T) {
-	err := &ConfigError{
-		Field:   "port",
-		Value:   "invalid",
-		Message: "must be a valid port number",
-	}
-
-	errStr := err.Error()
-	if errStr == "" {
-		t.Error("expected non-empty error string")
-	}
-}
-
-func TestGetCurrentOSUser(t *testing.T) {
-	user := GetCurrentOSUser()
-	if user == "" {
-		t.Error("expected non-empty user")
-	}
-}
-
-func TestDefaultPortFor(t *testing.T) {
-	if port := defaultPortFor("postgres"); port != 5432 {
-		t.Errorf("defaultPortFor(postgres) = %d, want 5432", port)
-	}
-	if port := defaultPortFor("mysql"); port != 3306 {
-		t.Errorf("defaultPortFor(mysql) = %d, want 3306", port)
-	}
-	if port := defaultPortFor("unknown"); port != 5432 {
-		t.Errorf("defaultPortFor(unknown) = %d, want 5432 (default)", port)
-	}
-}

internal/config/persist.go

@@ -28,11 +28,9 @@ type LocalConfig struct {
 	DumpJobs    int
 
 	// Performance settings
-	CPUWorkload     string
-	MaxCores        int
-	ClusterTimeout  int // Cluster operation timeout in minutes (default: 1440 = 24 hours)
-	ResourceProfile string
-	LargeDBMode     bool // Enable large database mode (reduces parallelism, increases locks)
+	CPUWorkload    string
+	MaxCores       int
+	ClusterTimeout int // Cluster operation timeout in minutes (default: 1440 = 24 hours)
 
 	// Security settings
 	RetentionDays int
@@ -42,11 +40,8 @@ type LocalConfig struct {
 
 // LoadLocalConfig loads configuration from .dbbackup.conf in current directory
 func LoadLocalConfig() (*LocalConfig, error) {
-	return LoadLocalConfigFromPath(filepath.Join(".", ConfigFileName))
-}
+	configPath := filepath.Join(".", ConfigFileName)
 
-// LoadLocalConfigFromPath loads configuration from a specific path
-func LoadLocalConfigFromPath(configPath string) (*LocalConfig, error) {
 	data, err := os.ReadFile(configPath)
 	if err != nil {
 		if os.IsNotExist(err) {
@@ -131,10 +126,6 @@ func LoadLocalConfigFromPath(configPath string) (*LocalConfig, error) {
 				if ct, err := strconv.Atoi(value); err == nil {
 					cfg.ClusterTimeout = ct
 				}
-			case "resource_profile":
-				cfg.ResourceProfile = value
-			case "large_db_mode":
-				cfg.LargeDBMode = value == "true" || value == "1"
 			}
 		case "security":
 			switch key {
@@ -216,12 +207,6 @@ func SaveLocalConfig(cfg *LocalConfig) error {
 	if cfg.ClusterTimeout != 0 {
 		sb.WriteString(fmt.Sprintf("cluster_timeout = %d\n", cfg.ClusterTimeout))
 	}
-	if cfg.ResourceProfile != "" {
-		sb.WriteString(fmt.Sprintf("resource_profile = %s\n", cfg.ResourceProfile))
-	}
-	if cfg.LargeDBMode {
-		sb.WriteString("large_db_mode = true\n")
-	}
 	sb.WriteString("\n")
 
 	// Security section
@@ -295,14 +280,6 @@ func ApplyLocalConfig(cfg *Config, local *LocalConfig) {
 	if local.ClusterTimeout != 0 {
 		cfg.ClusterTimeoutMinutes = local.ClusterTimeout
 	}
-	// Apply resource profile settings
-	if local.ResourceProfile != "" {
-		cfg.ResourceProfile = local.ResourceProfile
-	}
-	// LargeDBMode is a boolean - apply if true in config
-	if local.LargeDBMode {
-		cfg.LargeDBMode = true
-	}
 	if cfg.RetentionDays == 30 && local.RetentionDays != 0 {
 		cfg.RetentionDays = local.RetentionDays
 	}
@@ -317,24 +294,22 @@ func ApplyLocalConfig(cfg *Config, local *LocalConfig) {
 // ConfigFromConfig creates a LocalConfig from a Config
 func ConfigFromConfig(cfg *Config) *LocalConfig {
 	return &LocalConfig{
-		DBType:          cfg.DatabaseType,
-		Host:            cfg.Host,
-		Port:            cfg.Port,
-		User:            cfg.User,
-		Database:        cfg.Database,
-		SSLMode:         cfg.SSLMode,
-		BackupDir:       cfg.BackupDir,
-		WorkDir:         cfg.WorkDir,
-		Compression:     cfg.CompressionLevel,
-		Jobs:            cfg.Jobs,
-		DumpJobs:        cfg.DumpJobs,
-		CPUWorkload:     cfg.CPUWorkloadType,
-		MaxCores:        cfg.MaxCores,
-		ClusterTimeout:  cfg.ClusterTimeoutMinutes,
-		ResourceProfile: cfg.ResourceProfile,
-		LargeDBMode:     cfg.LargeDBMode,
-		RetentionDays:   cfg.RetentionDays,
-		MinBackups:      cfg.MinBackups,
-		MaxRetries:      cfg.MaxRetries,
+		DBType:         cfg.DatabaseType,
+		Host:           cfg.Host,
+		Port:           cfg.Port,
+		User:           cfg.User,
+		Database:       cfg.Database,
+		SSLMode:        cfg.SSLMode,
+		BackupDir:      cfg.BackupDir,
+		WorkDir:        cfg.WorkDir,
+		Compression:    cfg.CompressionLevel,
+		Jobs:           cfg.Jobs,
+		DumpJobs:       cfg.DumpJobs,
+		CPUWorkload:    cfg.CPUWorkloadType,
+		MaxCores:       cfg.MaxCores,
+		ClusterTimeout: cfg.ClusterTimeoutMinutes,
+		RetentionDays:  cfg.RetentionDays,
+		MinBackups:     cfg.MinBackups,
+		MaxRetries:     cfg.MaxRetries,
 	}
 }

internal/config/profile.go

@@ -1,128 +0,0 @@
-package config
-
-import (
-	"fmt"
-	"strings"
-)
-
-// RestoreProfile defines resource settings for restore operations
-type RestoreProfile struct {
-	Name               string
-	ParallelDBs        int  // Number of databases to restore in parallel
-	Jobs               int  // Parallel decompression jobs
-	DisableProgress    bool // Disable progress indicators to reduce overhead
-	MemoryConservative bool // Use memory-conservative settings
-}
-
-// GetRestoreProfile returns the profile settings for a given profile name
-func GetRestoreProfile(profileName string) (*RestoreProfile, error) {
-	profileName = strings.ToLower(strings.TrimSpace(profileName))
-
-	switch profileName {
-	case "conservative":
-		return &RestoreProfile{
-			Name:               "conservative",
-			ParallelDBs:        1, // Single-threaded restore
-			Jobs:               1, // Single-threaded decompression
-			DisableProgress:    false,
-			MemoryConservative: true,
-		}, nil
-
-	case "balanced", "":
-		return &RestoreProfile{
-			Name:               "balanced",
-			ParallelDBs:        0, // Use config default or auto-detect
-			Jobs:               0, // Use config default or auto-detect
-			DisableProgress:    false,
-			MemoryConservative: false,
-		}, nil
-
-	case "aggressive", "performance", "max":
-		return &RestoreProfile{
-			Name:               "aggressive",
-			ParallelDBs:        -1, // Auto-detect based on resources
-			Jobs:               -1, // Auto-detect based on CPU
-			DisableProgress:    false,
-			MemoryConservative: false,
-		}, nil
-
-	case "potato":
-		// Easter egg: same as conservative but with a fun name
-		return &RestoreProfile{
-			Name:               "potato",
-			ParallelDBs:        1,
-			Jobs:               1,
-			DisableProgress:    false,
-			MemoryConservative: true,
-		}, nil
-
-	default:
-		return nil, fmt.Errorf("unknown profile: %s (valid: conservative, balanced, aggressive)", profileName)
-	}
-}
-
-// ApplyProfile applies profile settings to config, respecting explicit user overrides
-func ApplyProfile(cfg *Config, profileName string, explicitJobs, explicitParallelDBs int) error {
-	profile, err := GetRestoreProfile(profileName)
-	if err != nil {
-		return err
-	}
-
-	// Show profile being used
-	if cfg.Debug {
-		fmt.Printf("Using restore profile: %s\n", profile.Name)
-		if profile.MemoryConservative {
-			fmt.Println("Memory-conservative mode enabled")
-		}
-	}
-
-	// Apply profile settings only if not explicitly overridden
-	if explicitJobs == 0 && profile.Jobs > 0 {
-		cfg.Jobs = profile.Jobs
-	}
-
-	if explicitParallelDBs == 0 && profile.ParallelDBs != 0 {
-		cfg.ClusterParallelism = profile.ParallelDBs
-	}
-
-	// Store profile name
-	cfg.ResourceProfile = profile.Name
-
-	// Conservative profile implies large DB mode settings
-	if profile.MemoryConservative {
-		cfg.LargeDBMode = true
-	}
-
-	return nil
-}
-
-// GetProfileDescription returns a human-readable description of the profile
-func GetProfileDescription(profileName string) string {
-	profile, err := GetRestoreProfile(profileName)
-	if err != nil {
-		return "Unknown profile"
-	}
-
-	switch profile.Name {
-	case "conservative":
-		return "Conservative: --parallel=1, single-threaded, minimal memory usage. Best for resource-constrained servers or when other services are running."
-	case "potato":
-		return "Potato Mode: Same as conservative, for servers running on a potato 🥔"
-	case "balanced":
-		return "Balanced: Auto-detect resources, moderate parallelism. Good default for most scenarios."
-	case "aggressive":
-		return "Aggressive: Maximum parallelism, all available resources. Best for dedicated database servers with ample resources."
-	default:
-		return profile.Name
-	}
-}
-
-// ListProfiles returns a list of all available profiles with descriptions
-func ListProfiles() map[string]string {
-	return map[string]string{
-		"conservative": GetProfileDescription("conservative"),
-		"balanced":     GetProfileDescription("balanced"),
-		"aggressive":   GetProfileDescription("aggressive"),
-		"potato":       GetProfileDescription("potato"),
-	}
-}